SOC
การคัดแยกการแจ้งเตือน
The systematic process of evaluating, prioritizing, and categorizing security alerts based on severity, credibility, and potential impact, enabling efficient resource allocation and rapid incident detection within a SOC, as described in NIST SP 800-61 and MITRE ATT&CK®.
Quick answer: The systematic process of evaluating, prioritizing, and categorizing security alerts based on severity, credibility, and potential impact, enabling efficient resource allocation and rapid incident detection within a SOC, as described in NIST SP 800-61 and MITRE ATT&CK®.
This term page is part of the Protermify Cybersecurity glossary and is published as static HTML for fast indexing and clear language coverage.
Quick answer
The systematic process of evaluating, prioritizing, and categorizing security alerts based on severity, credibility, and potential impact, enabling efficient resource allocation and rapid incident detection within a SOC, as described in NIST SP 800-61 and MITRE ATT&CK®.
Why it matters
การคัดแยกการแจ้งเตือน matters because it supports clear communication in SOC contexts for SOC Analysts, Security Engineers, and Incident Responders. It also connects to aviation training and exam language such as CISSP, CompTIA Security+, and CEH.
Editorial context
This page is rendered as static HTML from source-backed terminology data so search engines and AI systems can parse the content without client-side code.
Definition
The systematic process of evaluating, prioritizing, and categorizing security alerts based on severity, credibility, and potential impact, enabling efficient resource allocation and rapid incident detection within a SOC, as described in NIST SP 800-61 and MITRE ATT&CK®.
Operational example
During alert triage, analysts dismiss false positives and escalate high-fidelity alerts to incident handlers for rapid containment.
Localized term
การคัดแยกการแจ้งเตือน
Localized example
ในระหว่างการคัดแยกการแจ้งเตือน นักวิเคราะห์จะตัดการแจ้งเตือนผิดพลาดออกและส่งต่อการแจ้งเตือนที่มีความน่าเชื่อถือสูงไปยังผู้จัดการเหตุการณ์เพื่อการควบคุมอย่างรวดเร็ว
Definition language
English reference definition
Source
ISO 27001, NIST Cybersecurity Framework, MITRE ATT&CK
Exam relevance
- CISSP
- CompTIA Security+
- CEH
Target audience
- SOC Analysts
- Security Engineers
- Incident Responders
