Cyber Defense · lesson 5 of 12 · 15 min
Alert triage
summary: Alert triage sorts signals by urgency and context. Gather the facts, check the affected asset, and escalate through the approved process rather than assuming every alert is an incident.
question: What is the first goal of alert triage?
options:
- Gather context and prioritize responsibly
- Delete every alert
- Assume every alert is correct
- Disable monitoring
correct: Gather context and prioritize responsibly
explanation: Context helps teams decide which alerts need immediate attention.
Previous lesson: Symmetric encryption
Back to Cyber Defense
Next lesson: Hashing and integrity