When to use this
Use this record to document log review, alert triage, security impact assessment, escalation, and closure.
Related controls
- A.8.15 Logging
- A.5.25 Assessment and Decision on Information Security Events
- A.5.26 Response to Information Security Incidents
Triage record
| Alert/log ID | Date/time | Source | Event summary | Security impact? | Action taken | Escalated? | Closed by |
|---|---|---|---|---|---|---|---|
| TBD | TBD | TBD | TBD | Yes/No/TBD | TBD | Yes/No | TBD |
Minimum checks
- Alert or sampled log was reviewed.
- Security impact was assessed.
- Incident escalation occurred where needed.
- Closure evidence was retained.
- Template
- Iso27001
- Technological controls
- Logging
- Incident response
Note Metadata
Aliases: Log Alert Review Record
Source: 90 Templates/Log Review and Alert Triage Record.md
Related Notes
- ISO 27001 A.5.25 - Assessment and Decision on Information Security Events
- ISO 27001 A.5.26 - Response to Information Security Incidents
- A.8.15 Audit Evidence Pack
- ISO 27001 A.8.15 - Logging
- A.8 Technological Controls MOC
- A.8 Technological Controls Implementation Guide
- A.8 Technological Controls Audit Guide
- A.8 Technological Controls Implementation Audit Risk Mapping
- A.8.15 Audit Checklist
- Monitoring Alert Threshold Review
- Templates MOC