SOC Alert Triage Workflow
Develop a SOC alert-triage workflow and checklist using Wazuh.
Project objective
Turn "review the alerts" into an actual repeatable process: a fixed sequence of triage stages, a simple priority model that combines Wazuh's rule severity with asset criticality, and a documented decision path so every alert ends in an explicit escalate/investigate/close verdict rather than sitting unreviewed.
Core work
The workflow has five stages, applied to every alert above the ignore threshold:
- Detect — alert arrives in the Wazuh dashboard; note rule ID, level, and affected agent.
- Validate — confirm the alert isn't a known false positive or maintenance window activity.
- Scope — pull surrounding context: same source/agent activity in the time window around the alert.
- Prioritize — combine rule severity (Wazuh level) with asset criticality to assign P1–P4.
- Decide — close as benign, open an investigation, or escalate to incident response.
# Pull the highest-severity alerts from the last hour for triage
sudo tail -n 5000 /var/ossec/logs/alerts/alerts.json \
| jq -c 'select(.rule.level >= 10)' \
| jq -s 'sort_by(-.rule.level)'
# Scope: pull all activity from the same agent around the alert timestamp
sudo grep '"agent":{"id":"003"' /var/ossec/logs/alerts/alerts.json | tail -n 50
# Check whether the source has fired before (repeat offender = higher priority)
grep '"srcip":"203.0.113.44"' /var/ossec/logs/alerts/alerts.json | wc -l
# Priority model used for this workflow:
# P1 = rule level >= 12 AND asset is Tier-1 (internet-facing / prod)
# P2 = rule level >= 10, or repeat offender against any asset
# P3 = rule level 7-9, first occurrence, non-critical asset
# P4 = rule level < 7, known noisy rule, or already-mitigated patternA worked example: a level-10 "multiple failed SSH logins" alert against a Tier-1 jump host, from a source seen 4 times previously, was scoped, marked P2, and escalated for a firewall block plus a check for any successful auth from the same source — all inside the same triage pass rather than as a separate follow-up.
Triage outcomes for one week of test alerts, by verdict — most alerts close as benign once scoped, which is the expected shape for a healthy detection set.
What to document
Each triaged alert gets a short record: alert ID/rule, priority assigned and why, the scoping evidence that informed the decision, and the final verdict — enough that a second analyst could review the same alert later and reach the same conclusion from the notes alone.