<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-incident-classification
description: >-
  Automate incident classification with severity scoring, category assignment,
  priority calculation using alert context, asset criticality, and historical
  patterns for consistent SOC triage.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - incident-classification
  - triage
  - severity-scoring
  - categorization
  - soc
  - automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Incident Classification

## Overview

Incident classification automation applies consistent categorization, severity
scoring, and priority assignment to security incidents based on alert attributes,
asset context, threat intelligence, and historical patterns. This reduces
analyst bias and accelerates triage for high-volume SOCs.

Mode: `[MODE: BLUE]` — Automated triage and classification.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ | Required |
| SIEM or ticketing system API for incident data | Required |
| Asset inventory for criticality context | Required |
| Historical incident data for pattern matching | Required |

## Key Concepts

### Classification Taxonomy

```python
INCIDENT_CATEGORIES = {
    "malware": {"subcategories": ["ransomware", "trojan", "worm", "cryptominer"]},
    "phishing": {"subcategories": ["credential_harvest", "bec", "spear_phishing"]},
    "unauthorized_access": {"subcategories": ["brute_force", "credential_stuffing", "insider"]},
    "data_exfiltration": {"subcategories": ["email", "cloud_storage", "dns_tunnel"]},
    "denial_of_service": {"subcategories": ["volumetric", "application", "distributed"]},
    "policy_violation": {"subcategories": ["acceptable_use", "data_handling", "shadow_it"]},
}
```

### Severity Scoring

```python
def calculate_severity(incident: dict, asset: dict) -> dict:
    """Calculate incident severity from multiple factors."""
    base_score = {"critical": 4, "high": 3, "medium": 2, "low": 1}
    alert_severity = base_score.get(incident.get("alert_severity", "medium"), 2)
    asset_weight = {"mission-critical": 2.0, "high": 1.5, "standard": 1.0, "low": 0.5}
    asset_mult = asset_weight.get(asset.get("criticality", "standard"), 1.0)
    composite = min(round(alert_severity * asset_mult), 4)
    severity_map = {4: "critical", 3: "high", 2: "medium", 1: "low"}
    return {"score": composite, "severity": severity_map.get(composite, "medium")}
```

## Workflow

### Step 1: Classify Incident

```bash
node scripts/agent.js --action classify --incident INC-001
```

### Step 2: Batch Classification

```bash
node scripts/agent.js --action batch-classify --input /tmp/incidents.json
```

### Step 3: Classification Report

```bash
node scripts/agent.js --action report --period 7d
```

## Verification

- [ ] Classification assigns consistent categories for similar alert types
- [ ] Severity scores account for asset criticality
- [ ] Priority calculation reflects business impact
- [ ] Historical pattern matching improves accuracy over time

## References

- [NIST SP 800-61 — Incident Categories](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [FIRST CSIRT Services Framework](https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1)
