Soc Alert Triagev0.2.2

A Tier-1 analyst receives a Splunk alert for suspicious PowerShell execution on a production server. They use the skill to collect context, extract IOCs, map to MITRE ATT&CK, and produce a verdict and severity score. The structured report helps them escalate or close the alert with defensible reasoning.

An MDR analyst at a managed security provider triages a phishing alert from Microsoft Defender for a client's tenant. The skill guides them to classify the alert family, enrich indicators with threat intel, and recommend containment steps. The audit-ready report is shared with the client.

An incident responder uses the skill to triage a CrowdStrike Falcon detection of ransomware behavior on a critical asset. They follow the phases to map techniques, identify gaps, and assign a Critical severity. The output informs immediate containment actions.

A cloud security analyst receives a GuardDuty alert for anomalous API usage in a production AWS account. The skill helps them classify it as Cloud/SaaS, extract indicators, and map to MITRE ATT&CK. They produce a report with next steps for the cloud team.

A security engineer uses the skill to triage a false positive from their custom detection pipeline. The structured disposition helps them document why the rule fired incorrectly and what tuning is needed. This reduces alert fatigue and improves rule quality.

A cloud-based platform that integrates with SIEM, EDR, and XDR tools to provide automated alert triage assistance. Teams pay a monthly per-seat fee for the skill's structured workflow and reporting. The model scales with the number of analysts and alerts processed.

Security providers use the skill as part of their service offering to triage client alerts efficiently. The skill enables consistent, audit-ready reports that clients receive as part of the service. Revenue comes from retainer or per-incident fees.

The core skill is freely available to individual analysts, while enterprises pay for support, custom integrations, and advanced reporting features. This drives adoption and upsell to paid tiers. Revenue is generated through support subscriptions and professional services.