An organization's SIEM generates 500,000 events per day. The security team wants to prioritize which alerts to investigate first. Which framework BEST guides alert prioritization?
Select an answer to reveal the explanation.
Short Explanation
You want to prioritize alerts by risk, not by name or arrival time. A risk-based approach combines alert severity, asset criticality, and threat context so the most dangerous potential incidents get attention first.
Full Explanation
The correct approach is the risk-based approach that combines alert severity, asset criticality, and threat context to calculate a composite risk score. This works because risk-based prioritization multiplies threat severity by asset value and context — for example, whether the targeted asset is internet-facing or in PCI scope — ensuring the most impactful potential incidents receive attention first. The alphabetical-ordering option is wrong because alphabetical ordering has no relationship to risk. The chronological-ordering option is wrong because chronological ordering does not account for the relative risk of different alerts. The network-only option is wrong because endpoint alerts are critical sources of attack chain evidence, and ignoring them creates major blind spots.