ASD Essentials IT.DET-03.1 Triage Alerts and Events Promptly Against Defined Incident Thresholds
What it says
Triage alerts and events in a timely manner to determine whether cyber security incident thresholds have been met.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks each security alert and event quickly to decide whether it meets the organisation's threshold for a cyber security incident.
Security tools raise alerts, and staff report odd things, such as a suspicious email. Each one needs a quick first check, called triage, to decide if it is a real incident. To meet this, write down the triage steps and the rules for when an event becomes an incident. Set how fast each item must be checked, by how serious it is. Pass real incidents to the incident team, and track and report triage times.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
If alerts sit unchecked, wait too long or are judged without clear rules, a real attack can be missed or dismissed as noise. The attacker gets time to spread, steal data or disrupt services. Informal handovers can stop real incidents reaching the response team.
How to implement
The security operations manager should write the triage steps, have them approved and send every alert and reported event into one ticket queue.
Analysts record how serious each item is and why they closed it or passed it on.
The head of security should set and approve the rules for when an event becomes an incident, with levels of seriousness.
Review them when systems, services or risks change, and give analysts worked examples so decisions match.
Security management should set risk-based time limits for each level of seriousness and put enough people on triage to meet them.
Match them in any outside security provider's contract, and make the queue warn before a limit is missed.
The security operations manager should write a procedure for escalating incidents, saying who receives them, how to reach them after hours and how fast.
Analysts record each escalation in the ticket, with the time and who received it.
The security operations lead should report triage times, missed deadlines and the number of unchecked alerts to security management on a set schedule.
Find out why each deadline was missed and fix the cause.
Keep it running
Treat triage as a standing duty. A named person or team watches the queue, with on-call cover if alerts must be checked outside business hours. Watch for items nearing their deadline, and for more alerts than the team can handle. Raise staff or tool shortfalls with security management. This action applies organisation-wide, in every priority phase, so alerts from each new log source and rule go into the same queue, rules and time limits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the approved triage steps, the incident rules and the triage time limits.
Look at
Whether triage depends on personal judgement, or the rules and time limits are missing or vague.
Good evidence
Approved steps set the roles, rules and time limits for every alert and event.
- Check 2 of 5What an auditor asks for
Ask for
Request a sample of recent alerts and events, including ones closed as harmless and ones escalated.
Look at
Whether alerts sat unopened, were closed in bulk, or were closed with no reason or against the rules.
Good evidence
Each sampled item records its seriousness, the decision and a reason that fits the rules.
- Check 3 of 5What an auditor asks for
Ask for
Request when sampled items arrived, when they were triaged and the time limit that applied.
Look at
Whether time limits exist and are met, including after hours and for items a provider handles.
Good evidence
Items are checked within the time limit for their seriousness, including after hours.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the escalation procedure and records for items that counted as incidents.
Look at
Whether real incidents were escalated late, informally or not at all.
Good evidence
Incidents were escalated promptly under the written procedure, with the time and recipient recorded.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the triage performance measures and the latest reports to security management.
Look at
Whether triage speed and unchecked alerts are measured at all, and reported beyond the triage team.
Good evidence
Triage times and unchecked alerts are tracked and reported to security management on schedule.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No documented triage process exists.
- NE-2Alerts are routinely ignored or left unreviewed.
- NE-3No incident severity thresholds are defined.
Partially effective(2)
- PE-1A triage process exists but response times are not defined or consistently met.
- PE-2Severity thresholds are defined but escalation procedures are informal.
Fully effective(3)
- FE-1A documented triage process with defined severity thresholds and response timeframes is in place.
- FE-2Alerts are triaged within the timeframes defined by the organisation and escalated where cyber security incident thresholds are met.
- FE-3Triage performance is tracked and reported.
Mappings
Closest match in ISO/IEC 27001: A.5.25, Assessment and decision on information security events, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is equivalent to A.5.25.
IT.DET-03.1 requires alerts and events to be triaged in a timely manner to determine whether cyber security incident thresholds have been met. Annex A 5.25 requires information security events to be assessed and a decision made on whether to categorise them as information security incidents, which is substantially the same requirement. IT.DET-03.1 adds an explicit expectation of timeliness and refers to defined incident thresholds.
This control partially meets A.8.16.
IT.DET-03.1 requires alerts and events to be triaged in a timely manner to determine whether cyber security incident thresholds have been met. This corresponds to the part of Annex A 8.16 that requires appropriate actions to be taken to evaluate potential information security incidents. Annex A 8.16 is broader, as it also requires networks, systems and applications to be monitored for anomalous behaviour.
ASD Essential Eight: 16 mappings
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsPartially overlaps
This control partially overlaps E8-AC-ML2.7.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events, the detection step before triage.
This control partially overlaps E8-AC-ML2.8.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML2.8 requires cyber security events to be analysed in a timely manner to identify cyber security incidents, closely matching that triage.
This control partially overlaps E8-AC-ML3.4.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, which supplies events for that triage.
This control partially overlaps E8-AC-ML3.5.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events, feeding workstation events into that triage.
This control partially overlaps E8-AH-ML2.14.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events, surfacing the events that triage then assesses.
This control partially overlaps E8-AH-ML2.15.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents, the same core task, though IT.DET-03.1 also names alerts and thresholds.
This control partially overlaps E8-AH-ML3.4.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events, an earlier step that feeds triage.
This control partially overlaps E8-AH-ML3.5.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events, the detection step whose results are then triaged.
This control partially overlaps E8-MF-ML2.8.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML2.8 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events, one source of the events to be triaged.
This control partially overlaps E8-MF-ML2.9.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML2.9 requires cyber security events to be analysed in a timely manner to identify incidents, so both centre on promptly deciding which events are incidents.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events, an input to that triage.
This control partially overlaps E8-MF-ML3.5.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events, producing workstation events for triage to assess.
This control partially overlaps E8-RA-ML2.9.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML2.9 requires timely analysis of internet-facing server event logs to detect cyber security events, which that triage then assesses against the thresholds.
This control partially overlaps E8-RA-ML2.10.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents, the heart of that triage.
This control partially overlaps E8-RA-ML3.8.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML3.8 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events, so those events can then be triaged.
This control partially overlaps E8-RA-ML3.9.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML3.9 requires timely analysis of workstation event logs to detect cyber security events, detection that comes ahead of triage.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-0120.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; ISM-0120 requires cyber security personnel to have sufficient tools to detect events and identify incidents, which supports that triage.
This control partially overlaps ISM-0125.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; ISM-0125 requires a cyber security incident register to be developed, implemented and maintained, where incidents confirmed through triage can be recorded.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.