CYBRARY Unit 3 — SIEM alerts and cases
13 minTriage: true, false, or not yet known
How to work an alert in a few minutes without either dismissing a breach or escalating noise.
By the end you can
- Work an alert to a decision with a reason attached.
- Know the three or four checks that resolve most alerts.
- Write a dismissal somebody else can audit.
The four questions
Nearly every alert resolves against the same short list.
- What exactly fired, and on which machine and account?
- Is there an ordinary explanation — a change window, a patch run, a known tool?
- What happened around it on the same host in the minutes either side?
- Has the same thing happened on any other machine?
Dismissal is a decision, not a delete
Closing an alert as benign is fine and common. Closing it without the reason is not: the next person gets the same alert with no memory attached, and a pattern spread over weeks is never seen. Write the explanation and what you checked, in one line.
Check yourself
The strongest single move when an alert might be real is to…