Initial SOC Triage: First 15 Minutes
Alerts to Answers Analyst Field Guide 07 - v21
Purpose
This field guide provides a structured worksheet for the opening 15 minutes of alert triage. It helps an analyst read the alert before acting, compare the activity with an approved baseline, assemble relevant context, trace the activity, make an initial assessment, preserve evidence, and produce a clear handoff. The time bands begin when the analyst starts triage; they are prompts for disciplined progress, not waiting periods or mandatory limits.
Urgent escalation and authorized containment may occur at any time. Local policy, incident severity, business impact, response authority, and available evidence govern those decisions. The worksheet does not impose a universal confidence threshold and does not replace an organization's incident-response plan.
Chapter and Lab Alignment
| Alignment | Placement |
|---|---|
| Primary chapter alignment | Chapter 4 - Security Investigations |
| Supporting chapter alignment | Chapters 6, 7, and 8 |
| Lab alignment | Progressive Labs PL-01 through PL-09 when an alert or suspicious event requires structured triage |
| Recommended point of use | At the beginning of alert review and before deep investigation |
The Six Time Bands
| Elapsed time | Analyst focus | Required outcome |
|---|---|---|
| 0-1 minute | Read the alert | Identify the rule, event, source, entities, event time, and immediate safety concerns. |
| 1-3 minutes | Check what is normal | Compare the activity with the user, host, application, and approved-change baseline. |
| 3-7 minutes | Build the picture | Review related activity, peer systems, prior alerts, the search window, matches, and visibility gaps. |
| 7-10 minutes | Trace the activity | Follow the process tree, parent-child relationships, command line, files, connections, or equivalent identity/cloud sequence. |
| 10-13 minutes | Make the initial call | Assess scope, impact, severity, and uncertainty; escalate or contain only under approved authority. |
| 13-15 minutes | Summarize and hand off | Record findings, evidence, open gaps, ownership, the next action, and the next-update time. |
Operating Principles
- Document throughout the first 15 minutes rather than reconstructing the opening actions later.
- Preserve evidence as soon as it is identified. Record evidence identifiers and storage locations in the case record.
- Keep observations separate from assessments. Record uncertainty and plausible alternatives.
- Treat missing telemetry as a visibility gap, not proof that an event did not occur.
- Use UTC for evidence, decisions, actions, declarations, handoffs, due dates, and next-update timestamps.
- Record who authorized a containment or response action and the result of that action.
- Escalate when authority is unclear; do not improvise containment on a production system.
Using the Workbook
Download the blank triage workbook. Enter the case identifier once in the main sheet; the printed page headings update automatically. Enter the Eastern triage start date and time as directed in the workbook. The workbook calculates UTC and includes a Time Utility for daylight-saving and repeated-hour handling. All incident and evidence timestamps should be recorded in UTC.
The gold cells are analyst selections or entries. Complete the six time-band findings, their recorded-UTC fields, assessment, action, evidence, and handoff sections. Use the saved print area to export the four-page landscape report, and check Print Preview when the case identifier or narrative entries are unusually long.
The workbook is macro-free. Team leads must define local priority and severity thresholds, routing, containment authority, and escalation expectations before operational use. Workbook completeness checks verify that required fields and timestamps are present; they do not determine whether the analyst's conclusions are true.
Training Example
The complete Field Guide 07 package includes the blank workbook, a print preview, and a fictional populated example. The example demonstrates Office-to-script execution, peer and time-window comparison, a DNS visibility gap, evidence preservation, authorized isolation, and handoff. Its people, organization, systems, indicators, approvals, and evidence links are fictional.
Evidence and Reporting Boundary
The worksheet supports initial triage; it is not the final investigation report. At the end of the first 15 minutes, the analyst should be able to state what triggered the review, what was checked, what the available evidence supports, what remains unknown, what action was taken or requested, and who owns the next step. Continue the deeper investigation in the case-management and evidence systems required by local procedure.
References
- Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST Special Publication 800-53, Revision 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
- Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61, Revision 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). https://doi.org/10.6028/NIST.CSWP.29
See a Completed Example
Open the worked example and completion guide to see a fictional completed report, field-by-field guidance, and a final handoff checklist.