Text decision tree

Adapted from Appendix AK of Decision Trees: Frameworks for Technology Choices. Sources reviewed 2026-11-11.

START: Urgent incidents follow the response plan; every action needs an owner.
Q1. Required telemetry is usable?
  Yes -> Correlate the relevant events. SIEM supports security-data analysis. [Q2]
  No -> Otherwise fix collection, normalization or missing context first. [STOP]
Q2. Alert warrants investigation?
  Yes -> Triage and gather context. An alert is not a confirmed incident. [Q3]
  No -> Otherwise record the disposition and any tuning feedback. [END]
Q3. Incident confirmed by evidence?
  Yes -> Scope the incident and response. Follow severity and escalation rules. [Q4]
  No -> Otherwise continue the investigation or record a justified disposition. [STOP]
Q4. Response action is authorized?
  Yes -> Execute the approved workflow. SOAR can orchestrate response tasks. [Q5]
  No -> Otherwise obtain approval or escalate under the response plan. [STOP]
Q5. Recovery and lessons are complete?
  Yes -> Close with evidence and feedback. Update controls and detections. [END]
  No -> Otherwise continue recovery and review before closure. [STOP]
END: Retain evidence and feed lessons back into controls and detections.

AI-generated chapter illustration

Conceptual illustration for Follow the SOC response workflow

The image illustrates six operating stations rather than the five yes/no gates. Its invented queue/SLA ranges are illustration details, not recommendations or service commitments. The tool ecosystem and NIST phase labels are high-level context; the authored text and deterministic graph define the exact escalation, authorization and closure routing.

The illustration was generated in BookWriter. Its visual arrangement is interpretive; use the explicit nodes and routes in the graph and text tree for the decision.

Primary references