A SIEM alert arrives labelled 'Critical' by the detection rule's vendor: what does that severity actually describe?

## Where the number comes from Detection content — whether written in-house, bought from a vendor, or pulled from a community rule set — carries metadata alongside its logic: a title, a description, technique identifiers, an author, and a severity or risk score. That severity is authored *with the rule*, once, before it has ever run anywhere. It answers a single question: **if this behaviour is an intrusion, how bad is that?** Credential dumping is graded critical because credential dumping is critical when it is real. A signed utility pulling a remote file is graded high for the same reason. What the number cannot encode is anything about the environment it will run in, because at authoring time that environment does not exist. It does not know: - whether the host that fired it is a domain controller or an imaging workstation - whether the account is a human, a service account, or a privileged admin - whether a change record, a build job or a scheduled task explains the activity - how many hosts in your estate do this every day without incident All four of those are things the analyst holds and the author never could. That is why a Critical can be closed in two minutes and a Medium can become an incident. ## Severity is not confidence, and one number hides that Most platforms give you a single severity field, so two independent axes get compressed into it: - **Impact if true** — the damage implied by the behaviour actually being an adversary. - **Confidence in the match** — how strongly the rule's logic implies the behaviour actually occurred, as opposed to something that merely resembles it. A rule matching a specific malicious file hash is nearly certain when it fires but may be low impact if the file was blocked on arrival. A rule matching a broad command-line pattern has high impact if true and low confidence, because dozens of legitimate tools produce that pattern. Both can ship as "High". If your triage treats the two identically, you will spend the same effort on a near-certain small thing and a speculative large thing. Good content makes this explicit: a separate confidence or fidelity field, or a description that states the expected false-positive sources. When you only get one number, ask what the logic actually matches before you decide how much to trust the label. ## Deriving this alert's severity At triage you replace the shipped number with one you can defend, built from things you can look up in the time you have: 1. **Match confidence** — read the rule's logic, not just its title. Is this an exact artefact match or a behavioural pattern with known benign producers? 2. **The host's role** — what is this machine for, and is the flagged behaviour part of that job? 3. **The account** — its privilege, its normal hours, whether it is human or a service identity. 4. **How ordinary the behaviour is here** — the estate's own base rate for that command, not the rule's opinion of the technique. Note what is *not* on that list: how far an intrusion reached. Data classification, privilege reach and blast radius are how you grade an intrusion once you have declared one. They are a later question and a different conversation; at first verdict you are still deciding whether there is anything to declare. ## The two failure modes **Escalating on the label.** An analyst sees Critical and pages the on-call before a single lookup. Do this enough times and the escalation path stops being believed, which costs you the one time it was real. **Discounting the label.** The opposite drift: a rule family produces so many benign closures that its Criticals become background, and the analyst stops reading the logic at all. That is how a genuine hit gets closed in thirty seconds with the same click as the previous forty. The honest position is in between: the vendor's severity tells you what class of thing you are looking at and therefore what to look up first. It never tells you what happened on this host. ## What a good answer sounds like "That Critical describes the technique, not my estate — the author graded how bad it would be if it were an intrusion and shipped the same number to everyone. It also probably mixes impact with confidence in the match. I'd read what the logic actually matches, then re-derive severity from the host's role, the account, and how common that command is here. On a packaging workstation that Critical may be a two-minute close; the identical rule on a finance laptop is a different alert."