Incident › Module 2 › Lesson 2
Severity Matrix
Severity matrix literacy names P1–P4 tiers, impact criteria, and response SLAs — map severity on YOUR $IR_LAB tabletop injects before live incident classification.
Visual · t34_severity_matrix
Severity matrix literacy. $IR_LAB only. Original Cyberlium.
Opening
Not every alert is P1 — literacy teaches severity criteria so tabletop drills train proportionate response on scenarios you document.
Severity matrices classify incidents by impact — confidentiality, integrity, availability, safety, and regulatory exposure. P1 might mean active ransomware on production with customer data at risk; P4 might mean a single phishing email reported and quarantined. SLAs tie severity to response times and escalation paths. Cyberlium maps severity on YOUR $IR_LAB — classify three fictional tabletop injects with impact rationale. Next: Roles RACI.
1. Severity components (named)
Impact dimensions: data exposure, service outage scope, safety of life, regulatory notification triggers. Tier labels: P1 critical through P4 low — org-specific definitions. SLAs: time to acknowledge, time to contain, executive notification threshold.
On $IR_LAB, write severity row — inject title, tier, impact rationale, fictional SLA target.
Command guide
Try these commands — Severity components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/planning/severity-matrix.md" <<'EOF'
# Severity Matrix — YOUR org tabletop
| Sev | Name | Criteria (examples) | Response time | Escalation |
|-----|------|---------------------|---------------|------------|
| 1 | Critical | Active ransomware on prod; data exfil confirmed | 15 min | CISO + legal + exec |
| 2 | High | Malware on multiple hosts; privileged account compromise | 1 hr | IR lead + IT ops |
| 3 | Medium | Single host malware; phishing success isolated | 4 hr | SOC + IR analyst |
| 4 | Low | Blocked attack; policy violation; scan attempt | 24 hr | SOC ticket |
Lab: map LAB-IR-RANSOM-001 to Sev-1 tabletop — fictional assets only
EOFCommand — copy this
grep -E 'Sev|Critical|Ransomware|tabletop' "$IR_LAB/planning/severity-matrix.md"
python3 -c "print('Severity matrix: criteria + response time + escalation path')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why severity literacy prevents alert fatigue and under-response
Everything-as-P1 burns out IR teams and hides true crises. Under-severity delays containment on real incidents. Tabletops train consistent classification against written criteria.
Students classify lab injects on notes — production severity follows org matrix and incident commander judgment.
3. Lab boundary
Forbidden: declaring P1 on stranger networks to 'practice escalation.' Allowed: severity matrix card — three fictional injects with tiers and impact notes on $IR_LAB.
Ship: severity matrix card for YOUR lab injects. Next: Roles RACI.
4. What you ship: severity matrix card for $IR_LAB
Three injects with tier, impact, SLA. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Severity matrix card. $IR_LAB named. File t34-m02-l02-severity-matrix.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Label every tabletop P1 for drama. Skip impact rationale on lab notes.
Right
Write severity matrix card for YOUR $IR_LAB. Next: Roles RACI.
Mission: classify severity on YOUR lab
1) List four impact dimensions. 2) Classify three fictional injects with tier and rationale. 3) Write one SLA target per tier. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Impact rationale prevents tier inflation — document why, not just the label.
Knowledge Check
APPLY: Severity matrix primarily classifies:
Multiple choice
Knowledge Check
APPLY: True or False: P1 typically denotes the highest-impact incidents requiring fastest response.
True or False
Knowledge Check
APPLY: Severity literacy on Cyberlium uses:
Multiple choice