TriageLens - Part 1: Business understanding
Follow one incident from raw evidence to the analyst's decision. Each step links back to the matching part of the brief.
The problem A tier-1 analyst faces a queue that is too long to read in full. Most incidents are false alarms or harmless, and about one in five is a real attack.
Step 1 of 6
Detection products (endpoint, email, identity, cloud) raise alerts. Related alerts are grouped into incidents, and each incident carries pieces of evidence: the devices, accounts, files, IP addresses and URLs involved.
One zip of 538,287,656 bytes that unzips to 3,513,509,243 bytes.
GUIDE_Train.csvGUIDE_Test.csvStep 2 of 6
In the files we downloaded, 23,670 of the 1,033,998 incidents have no grade. The remaining 1,010,328 split into 49.0% benign positive, 30.4% false positive and 20.6% true positive.
Step 3 of 6
Grade each incident as true positive (TP), benign positive (BP) or false positive (FP), with a confidence and the reasons behind it (detectors, categories, ATT&CK techniques, entity types).
Step 4 of 6
Rank each organisation's queue so the incidents worth reading come first.
The ranks are about investigation priority, not about the grade: a top-ranked incident is not always a true positive.
Step 5 of 6
Propose auto-closes only where the chance of closing a real attack is held below a fixed limit, and send everything else to the analyst.
Step 6 of 6
The analyst decides; the tool proposes.
TriageLens proposes grades, an order and auto-closes. It does not close or escalate anything by itself, and every auto-close proposal shows its confidence and reasons.
Read the full brief, or print the poster.