Alert triage
Also called triage, alert triaging, triaging alerts
The first sort of security alerts: which are real, which are noise, and which need someone now.
Alert triage is the sorting a security team does before it investigates anything. Each alert gets a quick answer to 3 questions: is this real, how bad could it be, and who needs to look. The aim is to spend analysts' time by risk and not in the order the alerts arrived.
AI is offered for this work because it is fast, repetitive and mostly reading. Used as a helper, a model summarises the alert and an analyst decides. Used alone, it closes alerts that nobody then reads.
That second use needs a rule set in advance, since a wrong close stays hidden until somebody goes looking for it.
For example
40 alerts arrive in an hour. Triage closes 31 as known noise, groups 6 into one case and sends 3 to an analyst at once.
Put it to use
Where you'll meet alert triage in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.