incident-response

Incident triage classifies security events into 14 incident types and assigns severity levels. It processes SIEM alerts, EDR detections, threat intel, and user reports to generate structured outputs including incident type, severity, and escalation path for automated decision-making.

False-positive filtering validates escalation decisions by analyzing alert context and indicators. The triage process applies false-positive checks to SIEM and EDR alerts, returning specific false-positive indicators in structured output to reduce alert fatigue and prevent unnecessary escalations.

Yes, the tool supports tabletop exercises by simulating SEV1 through SEV4 scenarios. Security teams can input simulated event JSON to verify incident response playbooks, test classification accuracy, and validate escalation paths against defined severity levels and MITRE techniques.

Forensic analysis planning generates evidence collection guidance aligned with DFRWS phases and chain-of-custody requirements. The tool returns structured forensic analysis output alongside incident classification, enabling responders to preserve evidence and maintain documentation integrity throughout the investigation.

The tool operates on input JSON events representing security incidents. It processes structured data from SIEM alerts, EDR detections, threat intelligence feeds, or user reports, applying classification logic and false-positive checks to return standardized incident metadata for downstream automation.

Escalation paths are determined by mapping 14 incident types to default severities and MITRE techniques. The tool generates structured escalation path output that drives response SLAs, ensuring incidents route to appropriate responders based on classified severity and incident type.