soc-alert-triage

Specialist squad for SOC alert triage in cybersecurity.

Overview

The soc-alert-triage is a complete squad covering the entire security alert triage pipeline:

1. Alert Classification — Automated categorization by type, severity, and MITRE ATT&CK mapping from multiple sources (SIEM, IDS, EDR, cloud)
2. False Positive Filtering — FP identification and filtering using historical patterns, behavioral baselines, and contextual whitelists
3. Threat Prioritization — Risk scoring based on exploitability, blast radius, asset criticality, and business impact
4. Threat Intel Enrichment — IOCs, complete MITRE ATT&CK mapping, reputation scores, and historical correlation
5. Brief Generation — Actionable documents with timeline, recommended playbook, IOCs, and prioritized response actions

Pain Point: SOC analysts face 4,000+ alerts/day, with 80%+ being false positives — causing alert fatigue, burnout, and risk of missing real threats.

Agents

Workflows

Available Commands

Quick Start

# Activate the prioritizer (main orchestrator)
/sat:agents:threat-prioritizer

# Full alert triage pipeline
*triage-full

# Rapid classification
*rapid-classify

# Alert classification only
*classify-alerts

# Brief generation only
*generate-brief

Target Users

• SOC Analysts (L1, L2, L3)
• Security Engineers
• Threat Hunters
• CISOs and Security Leaders
• Incident Response Teams

Requirements

• Access to SIEM (Splunk, QRadar, Sentinel, Elastic SIEM)
• Access to threat intel feeds (VirusTotal, AbuseIPDB, MISP)
• Access to EDR tools (CrowdStrike, SentinelOne, Defender)
• MITRE ATT&CK framework as taxonomy reference