Comparisons Entity-centric vs alert-centric
Compare · Approaches
Entity-centric vs alert-centric triage
Most SOCs are organised around the alert: one row in the queue, one ticket, one verdict. Entity-centric triage turns the question around: what is happening to this machine, this account or this address, across everything we have seen? The difference changes what analysts read, how attacks are spotted and how cases are closed.
The alert as the unit of work
In an alert-centric SOC, each detection becomes an item to triage. Rules fire, alerts arrive, analysts open them one by one. The model is simple, maps well to SIEM rules and ticketing, and makes it easy to measure throughput.
Its weakness shows at volume. The same activity on the same host can fire many rules, so analysts see many alerts about one thing. A multi-step intrusion is spread across tickets that different people close on different days, each one looking minor on its own. And routine activity, such as backups or administration, keeps producing alerts that are closed again and again.
The entity as the unit of work
Entity-centric triage groups evidence around the things alerts are about: hosts, user accounts, IP addresses, domains, applications. Each entity carries its history, its normal pattern of activity, its open alerts and its relationships to other entities. A new alert is read as one more fact about that entity, not as a new problem.
The analyst then judges a story: what this account did over the last days, whether it is outside its usual pattern, what else it touched. Closing the entity’s case settles all the alerts that belong to it, and the attack that spans several alerts is visible as one sequence.
Side by side
| Dimension | Alert-centric | Entity-centric |
|---|---|---|
| Unit of work | One alert or ticket | One host, account, address or application and its story |
| Queue size | Grows with the number of rule hits | Grows with the number of entities in trouble |
| Context for the analyst | Gathered by hand for each alert | Carried by the entity: history, normal pattern, relations |
| Multi-step attacks | Spread across tickets | Seen as one sequence on the entities involved |
| Routine activity | Re-triaged every time it alerts | Recognised against the entity’s own normal pattern |
| Closing | Alert by alert | The entity’s case settles its alerts together |
| Main risk | Missing the story; fatigue | Over-merging unrelated activity on shared systems |
| Prerequisites | Rules and a ticket queue | Reliable entity identification across sources |
Where each approach fits
Alert-centric works when
Volume is modest, detections are precise, and each alert is self-explanatory. Many small SOCs run well this way.
Entity-centric works when
Volume is high, the same entities alert repeatedly, and attacks unfold over several steps and days.
Watch out for
Shared infrastructure such as domain controllers or identity hubs touches everything. Grouping must not let one hub merge unrelated stories into one giant case.
How ApexAI approaches it
ApexAI organises cases around entities and their stories, keeps one case per attack story and recognises activity that matches an entity’s own normal pattern. Shared hubs are handled so they do not glue unrelated stories together. Every alert still remains visible and traceable inside its entity’s case. Entity cases are in preview.
Questions
What is an entity in a SOC?
An entity is something alerts are about: a host, a user account, an IP address, a domain, a process or an application. Entity-centric triage collects all evidence about it in one place.
Do individual alerts disappear in entity-centric triage?
No. Alerts remain visible and traceable; they are simply read as part of the entity’s story instead of as separate tickets.
Does entity-centric triage reduce alert fatigue?
It usually reduces the number of items people need to look at, because many alerts about the same entity and story become one case. The gain depends on how reliably entities are identified across sources.
Can we mix the two?
Yes. Many teams keep high-precision alerts as direct items while grouping noisy, repetitive ones by entity. The approaches are not exclusive.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.