Triaged alerts are security notifications that an analyst or automated workflow has reviewed, assessed for urgency, and prioritized for follow-up. Triage may involve checking the alert’s source data, assessing its likely severity, and deciding whether it is a false positive, needs more investigation, or requires an incident response.
In a SIEM or managed security service, triage helps turn a high volume of detections into a usable response queue. Prioritization guides limited analyst time toward threats that may have the greatest impact, while clear escalation and ownership help ensure important alerts are acted on. Effective triage depends on useful log data, well-tuned detections, and consistent criteria; it does not by itself confirm that an attack occurred or that an alert has been fully resolved.