Simple: everyday language, with no technical background needed.
Understand it
Triage means deciding what an alert needs next. An unfamiliar sign-in location is a clue, not a conclusion. Travel, VPNs, shared infrastructure or an attacker can produce similar signals.
An analyst asks what changed, which account matters, what evidence supports each explanation and what action is proportionate. Record what is known separately from what is assumed.
Under the hood
Fictional evidence: 09:10 UTC new session; 09:12 recovery phone changed; 09:14 mailbox forwarding rule created. Review identity-provider audit events and mail audit records, confirm time zones and correlate account/session identifiers. These sample events are a teaching case, not a detection rule.
Compare with approved travel, help-desk activity and device changes. Check factor type, session issuance and subsequent actions. Missing endpoint telemetry is a gap, not evidence that the endpoint is clean.
Practitioner perspective
Prioritize privilege, asset sensitivity and active impact. State a hypothesis, supporting evidence, alternatives, confidence and next collection step. A plausible location anomaly alone may justify verification; an unapproved recovery change plus forwarding may justify urgent escalation under policy.
Use an independent user contact route and preserve evidence. Record why containment was or was not chosen, who approved it and what could falsify the hypothesis. Do not infer threat-actor identity from an IP match.
SIEM
Triage means deciding what an alert needs next. An unfamiliar sign-in location is a clue, not a conclusion. Travel, VPNs, shared infrastructure or an attacker can produce similar signals.
Illustrated analogy · Select the image to enlargeWatch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Alert
A login appears from a new location.
Read every step without animation
Single clue
- Alert. A login appears from a new location.
- Assumption. The location is treated as proof.
- Weak conclusion. Legitimate explanations are ignored.
A clue needs context.
Evidence-led triage
- Correlate. Review session and recovery changes.
- Compare. Check legitimate activity through a trusted route.
- Decide. Record confidence, gaps and next action.
A defensible conclusion can include uncertainty.
Attack view
A weak triage process closes an alert because MFA succeeded while ignoring unauthorized recovery changes afterward.
Defender view
- Correlate identity events with post-login activity.
- Document alternatives, evidence gaps and a proportionate next action.
Common mistakes
- A detection match is not proof of malicious intent.
- An unfamiliar country label is not reliable attribution.
Check your understanding
Active recall: explain this idea in 30 seconds
Triage means deciding what an alert needs next. An unfamiliar sign-in location is a clue, not a conclusion. Travel, VPNs, shared infrastructure or an attacker can produce similar signals.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.