Summary

Feedback on all aspects of projects is important, and feedback on the value and ratings of alerts is no different. If we aren’t capturing that information, then we’ll never be able to properly understand our risks when it comes to detection, and could have a false sense of security. Just as with responses, we want to continue down the path of automating as much as possible in an effort to get a core understanding of our successful detections and of ones that might need a little bit of help. Understanding that will allow us to have a more operational team and help assist you in becoming more scalable. From this chapter, you should be able to critically look at your triage process and identify additional actions, such as steps that can be automated to assist with your triage process, and you should be able to add other fields to capture data during triage that can be used to drive actions.

In the next chapter, we’ll discuss how to narrow down which alerts...