BSidesSATX 2023

Writing Effective Triage Notes in the SOC: The Importance of Clarity, Actionability, and Leadership Support
2023-06-10, 14:00–14:25, Track 3 (Moody Rm 102)

With remote work and ever-evolving threat scenarios, Security Operations Center(SOC) has a significant role. The SOC lays its foundation on people, processes, and technology. The confluence of process and technology plays a vital role in the analyst triaging/reviewing the alerts. In this presentation, I would go over a few tips for writing good triage notes, a topic that is not very well discussed, and the role of leadership.


With remote work and ever-evolving threat scenarios, Security Operations Center(SOC) has a significant role. The SOC lays its foundation on people, processes, and technology. The confluence of process and technology plays a vital role in the analyst triaging/reviewing the alerts. In this presentation, I would go over a few tips for writing good triage notes, a topic that is not very well discussed, and the role of leadership.

The presentation will provide tips to the listener to write coherent, actionable notes by the end, helping them to give a crisp summary of who, what, when, where, and how. It will also emphasize the crucial role of leadership in supporting and guiding SOC analysts in their efforts to safeguard the organization's digital assets. This is important because we can't align with the business and leadership without the proper guidance, and communication in the correct verbiage.

Abhishek Tripathi is an accomplished Managing Consultant in EY's Threat Detection and Response practice, bringing over seven years of experience in designing, building, and operationalizing Security Operation Centers (SOCs) worldwide. He holds a Master of Science degree in Computer Science from Syracuse University, New York. With a proven track record of success in the field of cybersecurity, Abhishek is passionate about staying up-to-date with the latest industry trends and technologies to help organizations safeguard their digital assets against evolving threats. As a mentor, Abhishek helps new analysts navigate the challenges and complexities of the cybersecurity industry.