thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Triage

Rapidly assessing alerts or incidents to determine validity, severity and priority for response.

Definition

Triage determines whether an alert is a true positive, its scope and impact, and which response path or tier it requires. Good triage relies on context such as asset criticality, user role, threat intelligence and related alerts. Automation and enrichment speed triage.

Example

Checking a suspicious login alert against VPN logs and user travel records before escalating.

Exam tip

Triage prioritizes by impact and criticality, not by alert arrival order.

Related terms