QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
Working alerts on Northgate SOC's floor up the triage staircase: a queue of 340 open alerts re-sorted by risk so a critical EDR alert is worked first instead of sitting unopened; the eight steps an alert climbs — intake, enrich, validate, scope, prioritize, investigate, escalate and close; a triage matrix weighing severity against business impact, a noisy DNS rule tuned from 4,021 to 38 alerts a month; and a closed case with its metrics recorded.
CY-MID-079Mid Level · SOC Operations

SOC Operations & Alert Triage — The Triage Staircase

A hands-on mid-level course that runs the SOC workflow from alert to closed case. Climb the triage staircase - eight steps: Intake, Enrich, Validate, Scope, Prioritize, Investigate, Escalate, and Close - turning a flood of alerts into fast, consistent, well-documented decisions. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

  • Intake and enrich alerts with the context triage needs.
  • Validate true vs false positives and scope the impact.
  • Prioritise and investigate consistently under load.
  • Escalate cleanly to IR and close cases with good records.
Price:৳8,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.