Alert fatigue is the number-one reason real attacks get missed. Good triage isn't about working faster - it's about working the right alert first.
Prioritize by impact x asset x confidence
- Impact - what could this do? Credential theft on a domain controller beats an unapproved browser extension every time.
- Asset criticality - a crown-jewel server or an admin account raises the stakes.
- Confidence - how likely is this a true positive? A behavioral rule with a signed, expected tool is probably noise.
A credential-dumping alert (LSASS access) on a DC is a drop-everything event. An expired TLS cert on a test box is a ticket for later.
A fast triage loop
- Enrich - who, what host, what account, what time, what came before?
- Decide - true positive, false positive, or needs-more-info.
- Act - escalate/contain the real ones; tune the noise.
- Document - a one-line verdict + why. Future-you (and audits) will thank you.
Beware the tells of a tuned-out attack
Attackers hide inside your alert fatigue. If a rule fires constantly and everyone ignores it, that's exactly where they'll operate. Tune noise down so the real signal stands out - don't just mute it.