Ravi Sir's Cyber Security Cards › Revision Cards
Alert Triage
Alert Triage Triage means quickly deciding what each alert is and what to do next. Severity = impact (production, customer data) + confidence. Low: a failed scan on a patched server. Critical: an admin login from a new country, then a new user created. Read the alert: which rule, which host, which u
Read card text
What this card says
What it is
Triage means quickly deciding what each alert is and what to do next.
How to judge
Severity = impact (production, customer data) + confidence.
Low: a failed scan on a patched server. Critical: an admin login from a new country, then a new user created.
Steps
Read the alert: which rule, which host, which user.
Check the logs. Decide: false positive, true positive, or escalate.
| Outcome | Meaning | Example |
|---|---|---|
| True positive | Real attack, alert is correct | Brute force followed by successful login from an unknown… |
| False positive | Alert fired but nothing bad happened | Admin mistyped their password five times |
| True negative | No alert, nothing bad | Normal traffic |
| False negative | Attack happened but no alert – the most dangerous | Attacker used a valid stolen password during office hours |
Learn more in the lesson: 31.5 Alert Triage