Security Alert Triage and Investigation Questions

Describe a structured approach to triaging and investigating security alerts: initial intake and severity scoring, enrichment with host, network and identity context, identification of indicators of compromise, timeline reconstruction and correlation across sources, pivoting to scope and blast radius, containment and remediation decision making, escalation criteria and communication, and documentation. Include playbook and automation patterns that speed triage and reduce false positives, and discuss metrics to evaluate triage effectiveness.