In the course's simplified staffing model, Tier 1 SOC personnel primarily perform alert monitoring and _____.

### Why this is right Tier 1 analysts monitor incoming alerts and perform triage, meaning they assess urgency, context, and whether escalation is needed. The material describes deeper investigation at Tier 2 and incident response or forensic analysis at Tier 3. ### The concept Tiering organizes work by investigation depth and expertise. A Tier 1 analyst may dismiss a known benign alert, gather initial context, or escalate a credible threat. Tier 2 performs deeper investigation and threat hunting. Tier 3 handles advanced incident response and forensic analysis. Exact titles and divisions vary across organizations, but the course's model illustrates increasing analytical depth. ### Terms - **Triage**: Initial assessment used to prioritize and route an alert or case. - **Threat hunting**: Proactive searching for signs of compromise that automated alerts may have missed. ### Remember Tier 1 sorts and prioritizes; higher tiers investigate and handle more complex cases.