Security Alert Triage Workflow: From Alert Fatigue to Ranked Incidents
Security teams drown in alerts, most of them benign. The workflow takes each alert from the SIEM or EDR, enriches it — asset owner, user context, threat intel, recent related events — scores it against your rules and known-benign patterns, auto-closes the noise with a documented reason, and gives analysts a ranked queue where each alert already has the timeline, the enrichment and a suggested first action.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 11, 2026
The problem
Analysts spend most of their shift on alerts that turn out to be nothing, each one requiring the same lookups. Real incidents wait in the same queue. Tuning is never done because nobody has time to analyse which rules produce noise.
What changes when it runs
Benign patterns are closed automatically with an audit trail. Analysts open a queue ranked by risk where every alert carries the context they would have spent twenty minutes collecting. Mean time to triage falls, escalations are more accurate, and the weekly noise report tells the team exactly which detection rules to tune.
Trigger, then 8 steps
Trigger
SIEM / EDR webhook (alert created)
Splunk, Sentinel, Elastic, CrowdStrike, SentinelOne, Wazuh or Google SecOps posts new alerts; a polling fallback exists for tools without webhooks.
Receive and normalise the alert
WebhookSource, rule, severity, entities (host, user, IP, hash, domain), timestamps and raw event, normalised into a common schema regardless of source.
Enrich entities
HTTP RequestAsset owner and criticality from the CMDB, user role and recent auth activity from the identity provider, IP and domain reputation from threat-intel feeds, file hash lookups, and geolocation.
Correlate with recent activity
PostgresRelated alerts and events for the same entities in the last 24 hours, so a single alert is seen as part of a sequence when it is one.
Score and classify
CodeDeterministic score from severity, asset criticality, user privilege, intel hits and correlation count; known-benign patterns (scheduled scans, approved admin tools, backup jobs) match against an allowlist maintained by the team.
Analyst-style assessment
AI AgentFor alerts above the noise threshold, the agent writes the assessment: what the activity looks like, what is unusual for this entity, the most likely benign and malicious explanations, and the first three investigation steps with the exact queries to run.
Auto-close or queue
SwitchAllowlisted patterns close with the reason recorded; low scores close after the assessment confirms benign; everything else enters the queue ranked by score with the assessment attached.
Notify and escalate
SlackHigh-score alerts page the on-call analyst with the assessment; critical patterns (credential dumping, ransomware indicators) trigger the incident channel and the playbook immediately.
Weekly tuning report
Schedule TriggerAlerts by rule, auto-close rate, analyst dispositions vs workflow scores, and the top ten noise-producing rules with suggested tuning.
Data it touches
- SIEM / EDR alerts (Splunk, Sentinel, Elastic, CrowdStrike, SentinelOne)
- CMDB / asset inventory
- Identity provider logs (Okta, Entra ID)
- Threat intelligence (VirusTotal, AbuseIPDB, MISP, vendor feeds)
- Allowlist of known-benign patterns and the incident playbooks
Guardrails
- The workflow never takes containment actions (isolate host, disable user) on its own; it recommends and a human executes, or a separate approved playbook runs with explicit authorisation.
- Auto-closed alerts keep the full enrichment and reason and are sampled weekly for false-negative review.
- Critical patterns bypass scoring and page immediately.
- The allowlist is versioned, owned by the security lead, and every match is logged.
Enrichment first, model second
The analyst's twenty minutes per alert are mostly lookups: who owns this host, is this user an admin, is this IP known-bad, what else happened on this machine today. Every one of those is an API call, and the workflow makes all of them before anyone — or any model — looks at the alert. Deterministic scoring on the enriched alert then closes the obvious noise. The language model is reserved for the alerts that survive, where its job is to write the assessment an analyst would write after those lookups, with the next queries ready to paste.
Auto-closing safely
Auto-close is where security teams rightly hesitate. The workflow's answer is transparency and sampling: every closed alert keeps its full enrichment and the specific reason (allowlist match X, or score below threshold with assessment Y), and a random sample of closures is reviewed weekly. If the sample finds a false negative, the pattern or threshold is changed that week. This is stricter than the current state at most teams, where alerts are closed in bulk with no reason recorded.
The tuning report is the real product
Alert fatigue is a detection-engineering problem: a handful of rules produce most of the noise. The weekly report ranks rules by noise contribution and shows analyst dispositions against workflow scores, so the team can tune or retire rules with data. Teams that act on the report see alert volume fall month over month, which no amount of triage automation achieves on its own.
Tools in the stack
| Tool | Role in this workflow |
|---|---|
| n8n | Ingestion, enrichment, scoring, routing, reporting |
| Claude | Analyst-style assessments and investigation steps |
| Splunk / Sentinel / CrowdStrike | Alert sources |
| VirusTotal / AbuseIPDB / MISP | Threat intel |
| Slack / PagerDuty | Notifications and paging |
Want this running without building it?
Automation workflow
$297/month
We set up, host and maintain this workflow on n8n and connect it to your tools. Setup included, cancel monthly, you keep the JSON.
Custom build
$6,000–12,000 one-time
Your systems, your rules, your edge cases. A one-off build on Claude and n8n, delivered with documentation and a walkthrough.
Covers one SIEM or EDR source and up to 20,000 alerts a month. Multiple sources, SOAR-style response playbooks or a self-hosted model for sensitive telemetry are a custom build.
Frequently asked questions
Can it isolate hosts or disable users?
Not by default. Containment actions are recommended in the assessment and executed by an analyst. Approved response playbooks with explicit authorisation and logging can be added as a custom build for specific high-confidence scenarios.
Is telemetry sent to a third-party model?
Only alerts above the noise threshold reach the model, with entity values that can be pseudonymised; the provider does not train on the data. A self-hosted model is available for teams that require it.
How is this different from a SOAR platform?
SOAR platforms are broad and expensive; the workflow does the triage and enrichment part inside your n8n, with your allowlist and scoring, for a fraction of the cost. Teams with a SOAR can run it as the enrichment and assessment layer in front of it.
Case study
AI Cybersecurity Agent for Financial Services: 85% Faster Threat Response
How a mid-size bank deployed an AI cybersecurity agent to detect and contain threats 85% faster while reducing false-positive alert volume by 70%.
Calculator
Put your own numbers in
Estimate the cost of the current process and what this workflow changes.
The pillar
AI Cybersecurity Agent
Triage alerts, hunt threats, and automate incident response runbooks.