skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

alert-triage

Triage security alerts through four-phase evidence collection and disposition classification.

44|128|Updated Mar 6, 2026
Search Tags:#mitre att&ck#false positive#incident triage#alert escalation#soc analyst#nist sp 800-61#security alert
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill alert-triage-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: alert-triage
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/secops/alert-triage
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill alert-triage-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill turns ambiguous security alerts into consistent, framework-mapped triage decisions so SOC analysts can quickly determine true positives versus false positives and what to do next.

Core Features & Use Cases

  • Four-phase triage workflow: Collect, correlate, classify, and escalate using a repeatable checklist.
  • Framework grounding: Maps investigation guidance to MITRE ATT&CK v16 and NIST SP 800-61 Rev 2 to improve auditable decision quality.
  • Actionable disposition output: Produces alert disposition (TP/BTP/FP), priority (P1–P4), confidence, and escalation recommendations.
  • Use case: When your SIEM/EDR generates an alert and you need to answer “Is this a true positive?” while capturing evidence and rationale for tuning or escalation.

Quick Start

Use the alert-triage skill to triage a newly received alert by providing the alert payload and an alert identifier such as "CVE-ID-or-alert-ID" as context.

Frequently Asked Questions about alert-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage security alerts to determine if they are true positives or false positives?▼

Security alert triage involves collecting evidence, correlating related activity, and classifying dispositions to determine true positive versus false positive. Structured workflows map investigations to MITRE ATT&CK and NIST SP 800-61 for auditable decision quality.

What is the best way to prioritize a SOC alert queue using MITRE ATT&CK?▼

Prioritizing a SOC alert queue requires correlating alert activity and classifying priority levels from P1 to P4. Mapping investigation guidance to MITRE ATT&CK v16 ensures consistent escalation recommendations and structured triage outcomes.

How do I classify a benign true positive versus a false positive during incident triage?▼

Classifying a benign true positive versus a false positive requires collecting evidence and correlating related activity during incident triage. A four-phase methodology produces clear TP, BTP, or FP dispositions with confidence levels.

Does this alert triage process follow NIST SP 800-61 Rev 2 incident handling guidelines?▼

Yes, the alert triage process follows NIST SP 800-61 Rev 2 incident handling guidelines. It applies a four-phase methodology to collect, correlate, classify, and escalate security alerts while producing auditable disposition and priority outputs.

How do I escalate security alerts with priority guidance?▼

Escalating security alerts with priority guidance requires classifying disposition and assigning P1 to P4 priority levels. The escalation phase produces actionable recommendations while observing prompt-injection and data-handling constraints.

What are the limitations of automated security alert triage?▼

Automated security alert triage limitations include prompt-injection and data-handling constraints that require observation. Analysts must provide alert payloads and identifiers while the system maps evidence to MITRE ATT&CK and NIST frameworks.

Related Skills

Explore More Data & Analytics Skills→
FuzzdkkFuzzdkk
3

alert

Generate structured SOC alert triage steps and SIEM/EDR queries.

Community
Intermediate
greyhaven-aigreyhaven-ai
29

Incident Response Skill

Automate incident response with runbooks, root cause analyses, and postmortem documentation.

Community
Basic
Jayarr03Jayarr03

mitre-attack-review

Map system attack paths to MITRE ATT&CK techniques and objectives.

Community
Advanced
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate