# A Field Guide to SOC Alert Triage: Clear the Known-Good First

> Most SOC alert triage advice starts with the blocklist. That's backwards. Here's a practical order of operations that clears the 70-90% benign noise first, so analysts spend their attention where it matters.

- Published: 2026-07-06
- Author: Reput.io Team
- Tags: SOC, Alert Triage, Security Operations, Threat Intelligence
- Canonical: https://www.reput.io/blog/soc-alert-triage-known-good-first

---
> **Upfront disclosure:** This is written by the small team building Reput.io, not a marketing department. Every number below is either public research or pulled directly from our own API and labelled as such. We'd rather earn trust that way.

Ask ten analysts how they triage an alert and most will describe the same reflex: take the indicator, check it against the blocklists and threat feeds, and see if anything lights up. It's the natural first move, because "is this known-bad?" feels like the question the alert is asking.

The problem is what happens when the answer is *no*. A blocklist miss doesn't mean benign. It means "not on a list I checked." So the analyst is left where they started, now with a few minutes gone, staring at an IP that belongs to some large provider and deciding whether to keep digging or move on. Multiply that by the volume a real SOC sees and you get the number everyone quotes: roughly **70 to 90% of alerts are false positives** (see the [Ponemon analyst-fatigue research](https://www.ponemon.org/) and IBM's [Cost of a Data Breach](https://www.ibm.com/reports/data-breach) work). Those aren't failures of the detection rules. They're the cost of triaging in the wrong order.

## Flip the order of operations

The more efficient question to ask first isn't "is this known-bad?" It's **"is this known-good?"** Because the known-good set is large, well-defined, and cheap to check, while the known-bad set is small and adversarial. If you can confidently clear an indicator as legitimate infrastructure, you close the alert and never spend the analyst minute at all.

A workable triage order looks like this:

**1. Clear the demonstrably legitimate.** Public DNS resolvers, first-party infrastructure that doesn't resell hosting (Apple, Meta, government registries), verified corporate domains. These are safe to auto-close. In our API these come back `whitelisted` with a `likely_benign` verdict:

```json
{ "indicator": "8.8.8.8",
  "status": "whitelisted",
  "verdict": "likely_benign",
  "recommendation": { "action": "allow" } }
```

**2. Contextualize the grey infrastructure, but don't clear it.** This is the trap. A huge share of the noise is CDN, cloud, and SaaS traffic: a Cloudflare edge node, an Azure App Service IP, a rotated SendGrid range. With no context, the reflex is to either block it (breaks real traffic) or wave it through (misses the case where an attacker rented the same infrastructure). Neither is triage. The right move is to label what it is and keep it at `investigate`, with a concrete next step:

```json
{ "indicator": "13.107.42.14",
  "status": "enrichment",
  "verdict": "investigate",
  "recommendation": { "action": "investigate" } }
```

Note that "big brand" is not a shortcut here. A Microsoft-owned range can still come back `investigate` rather than benign, precisely because those ranges host customer-controlled workloads. The label corrects the misidentification; it does not lower the guard.

**3. Now hit the blocklists.** With the benign infrastructure gone and the grey stuff contextualized, what's left is a much smaller, higher-signal set, and *that's* where known-bad lookups, sandboxing, and analyst judgment earn their keep.

## Why "known-good first" is safe (and where it isn't)

The obvious objection: doesn't auto-clearing risk a false negative? It does, if you clear the wrong things. That's why step 1 is deliberately narrow, first-party infrastructure that *cannot* host arbitrary customer workloads, and step 2 explicitly refuses to clear cloud and CDN ranges even when the brand looks reassuring. The failure mode we care most about isn't a noisy alert; it's a missed one. So the rule is asymmetric: strong evidence can *correct a label*, but it can't *upgrade a customer-controlled cloud IP to benign*.

Done that way, clearing known-good first doesn't trade safety for speed. It removes work that shouldn't have reached a human, and leaves the genuinely ambiguous cases with more context attached, not less.

## Making it automatic

None of this requires a rip-and-replace. The order of operations is just a lookup that runs before your existing enrichment: pass the indicator, get back a verdict (`likely_benign` / `investigate`), a provider label, and a next step. The benign infrastructure closes itself; the grey infrastructure reaches the analyst already labelled. If you want to wire that into Splunk or Sentinel, we wrote up [how the SIEM enrichment works](/siem).

If you're curious what your own noisy IPs return, the [API preview](/api-preview) runs a lookup with no account needed.