triaging-security-alerts-in-splunk

# Triaging Security Alerts in Splunk ## When to Use Use this skill when: - SOC Tier 1 analysts need to process the Incident Review queue in Splunk Enterprise Security (ES) - Notable events require rapid severity classification and initial investigation before escalation - Alert volume exceeds capacity and analysts need a systematic triage methodology - Management requests metrics on alert disposition (true positive, false positive, benign) **Do not use** for deep forensic investigation — escalate to Tier 2/3 after initial triage confirms malicious activity. ## Prerequisites - Splunk Enterprise Security 7.x+ with Incident Review dashboard configured - CIM-normalized data sources (Windows Event Logs, firewall, proxy, endpoint) - Role with `ess_analyst` capability for notable event status updates - Familiarity with SPL (Search Processing Language) ## Workflow ### Step 1: Access Incident Review and Prioritize Queue Open the Incident Review dashboard in Splunk ES. Sort notable events by urgency (calculated from severity x priority). Apply filters to focus on unassigned events: ```spl | `notable` | search status="new" OR status="unassigned" | sort - urgency | table _time, rule_name, src, dest, user, urgency, status | head 50 ``` Focus on Critical and High urgency events first. Group related alerts by `src` or `dest` to identify attack chains rather than treating each alert independently. ### Step 2: Investigate the Notable Event Context For each notable event, pivot to ...