Severity Matrix
Severity matrix literacy names P1–P4 tiers, impact criteria, and response SLAs — map severity on YOUR $IR_LAB tabletop injects before live incident classification.
Visual · t34_severity_matrix
Severity matrix literacy. $IR_LAB only. Original Cyberlium.
Not every alert is P1 — literacy teaches severity criteria so tabletop drills train proportionate response on scenarios you document.
Severity matrices classify incidents by impact — confidentiality, integrity, availability, safety, and regulatory exposure. P1 might mean active ransomware on production with customer data at risk; P4 might mean a single phishing email reported and quarantined. SLAs tie severity to response times and escalation paths. Cyberlium maps severity on YOUR $IR_LAB — classify three fictional tabletop injects with impact rationale. Next: Roles RACI.
1. Severity components (named)
Impact dimensions: data exposure, service outage scope, safety of life, regulatory notification triggers. Tier labels: P1 critical through P4 low — org-specific definitions. SLAs: time to acknowledge, time to contain, executive notification threshold.
On $IR_LAB, write severity row — inject title, tier, impact rationale, fictional SLA target.
Command guide
Try these commands — Severity components (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why severity literacy prevents alert fatigue and under-response
Everything-as-P1 burns out IR teams and hides true crises. Under-severity delays containment on real incidents. Tabletops train consistent classification against written criteria.
Students classify lab injects on notes — production severity follows org matrix and incident commander judgment.
3. Lab boundary
Forbidden: declaring P1 on stranger networks to 'practice escalation.' Allowed: severity matrix card — three fictional injects with tiers and impact notes on $IR_LAB.
Ship: severity matrix card for YOUR lab injects. Next: Roles RACI.
4. What you ship: severity matrix card for $IR_LAB
Three injects with tier, impact, SLA. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Severity matrix card. $IR_LAB named. File t34-m02-l02-severity-matrix.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Label every tabletop P1 for drama. Skip impact rationale on lab notes.
- Right: Write severity matrix card for YOUR $IR_LAB. Next: Roles RACI.
Mission: classify severity on YOUR lab
1) List four impact dimensions. 2) Classify three fictional injects with tier and rationale. 3) Write one SLA target per tier. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Impact rationale prevents tier inflation — document why, not just the label.
APPLY: Severity matrix primarily classifies:
APPLY: True or False: P1 typically denotes the highest-impact incidents requiring fastest response.
APPLY: Severity literacy on Cyberlium uses: