Tier 1 – Triage: This is where security analysts typically spend most of their time. Tier 1 analysts are typically the least experienced analysts, and their primary function is to monitor event logs for suspicious activity. When they feel something needs further investigation, they gather as much information as they can and escalate the incident to Tier 2.

Tier 2 – Investigation: Tier 2 analysts dig deeper into suspicious activity to determine the nature of a threat and the extent to which it has penetrated the infrastructure. These analysts then coordinate a response to remediate the issue. This is a higher-impact activity that generally requires more experienced analysts.

Tier 3 – Threat hunting: The most experienced analysts support complex incident response and spend any remaining time looking through forensic and telemetry data for threats that detection software may not have identified as suspicious. The average company spends the least time on threat hunting activities as Tier 1 and Tier 2 consume so many analyst resources.