Generate structured SOC alert triage steps and SIEM/EDR queries.
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill alert-fuzzdkk
Please help me install this Agent Skill. Skill: alert Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/alert Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill alert-fuzzdkk
SOC alert triage and investigation guidance to quickly convert alert details and observables into structured investigation steps, hypotheses, and recommended queries for SIEM/EDR.
Paste an alert description and observables into the prompt to receive structured triage guidance and recommended actions.
High-intent search queries and answers about installing and using this skill.
SOC alert triage converts alert details and observables into structured investigation steps, classification, and containment suggestions. Paste the alert description and observables into the prompt to receive hypothesis-driven guidance and recommended actions.
Hypothesis-driven investigation generates potential threat scenarios from alert data to guide evidence collection. It structures the triage process by forming testable assumptions about the alert, enabling targeted queries and faster incident response.
Yes, this applies to security operations center workflows involving SIEM and EDR alerts across both single host and enterprise environments. It processes indicators of compromise and case notes to deliver deterministic triage guidance.
The triage guidance provides ready-to-run SIEM and EDR queries for common observable types. Input the alert description and observables to receive structured playbooks that include recommended queries for evidence collection.
Yes, the alert triage guidance operates without external dependencies or components. It generates structured investigation steps, containment recommendations, and evidence collection prompts directly from the provided alert text and observables.
Automated SOC alert triage accelerates incident response by generating step-by-step playbooks from detection alerts. It provides initial assessment, containment suggestions, and evidence collection prompts to streamline the workflow from detection to containment.
jassicsAutomate SIEM/EDR alert triage with validation, enrichment, and verdict decisions.
balsm-healthAutomate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.
dapperdiversExport and distribute validated IOCs across security platforms.
zenobi-usCoordinate incident response for security breaches and operational incidents.
