Skip to main content

#triage

Every article tagged “triage”, newest first.

Articles tagged triage

Abstract dark diagram of many dim branching paths with one amber route traced unbroken from left to right

Best Practices

SOC Playbook Template: Steps, Queries and Thresholds

Copy this SOC playbook template: triggers, steps, SPL/KQL/Lucene queries and branch thresholds for one alert type, with two filled-in examples.

Nicole Dobrovolskyy23 min read
Windows Security event log entries displayed in a SIEM console, showing event IDs for authentication and process activity

Tutorials

Windows Event IDs & Codes Cheat Sheet: The 31 That Matter

The 31 Windows event IDs and codes SOC analysts triage most: logon, Kerberos, process, services, Sysmon, log clearing, plus detection pages for 12 of them.

Astrid Lindqvist18 min read
Network traffic analysis dashboard showing TCP and UDP port connections, firewall logs, and protocol distribution for SOC triage

Tutorials

Common Port Numbers Cheat Sheet: 42 Ports for SOC Triage

The 42 TCP/UDP port numbers SOC analysts read in firewall logs and SIEM alerts, what each one means in triage, and a printable cheat sheet image to save.

Astrid Lindqvist21 min read
Wax-sealed envelope beside a magnifying glass on a dark surface with a glowing phishing hook and orange code overlay in the background

Tutorials

How to Analyze a Phishing Email: SOC Walkthrough

A step-by-step SOC workflow to analyze a phishing email: safe handling, header forensics, URL and attachment triage, and a documented verdict.

Astrid Lindqvist18 min read
Close-up of a dark SIEM dashboard on a widescreen monitor, rows of alerts highlighted in orange, gloved hands at the keyboard

Tutorials

Alert Triage: Real Threats vs False Positives

Alert triage is the core SOC skill. Learn the framework analysts use to assess severity, confirm IOCs, and separate real threats from false positives.

Astrid Lindqvist14 min read
Two silhouettes facing each other across a table with a large curved orange-lit world map and data dashboard screen behind them

Best Practices

SOC Analyst Interview Questions: 30 With Answers

SOC analyst interview questions decoded: what interviewers test, sample answers, and log examples to study before your first security ops interview.

Astrid Lindqvist19 min read
Dimly lit security operations center with a lone analyst seated at a curved desk of orange-glowing monitors, server racks lining the walls

Best Practices

What Does a SOC Analyst Do? The Role, Explained by Tier

What does a SOC analyst do? A tier-by-tier breakdown of the role, a realistic daily shift, tools, skills, and common myths, for career switchers.

Astrid Lindqvist18 min read