triaging-security-alerts-in-splunk - Splunk Security Alert Triage Skill
Classifies security alerts in Splunk Enterprise Security by investigating notable events and making disposition decisions
Tags
Updated: 2026-05-09Capabilities
Typical Inputs
Typical Outputs
What this skill does
- access Incident Review dashboard
- prioritize alert queue
- investigate notable events
- correlate telemetry data
- query threat intelligence
- classify alert severity
- update event status
- document findings
Inputs
- Splunk Enterprise Security instance
- CIM-normalized data sources
- Incident Review dashboard
- asset lookup tables
- identity lookup tables
- threat intelligence feeds
Outputs
- triage report
- alert disposition status
- updated notable events
- triage metrics
Requirements
- Splunk Enterprise Security 7.x+
- Incident Review dashboard
- CIM-normalized data sources
- ess_analyst capability
- SPL knowledge