Triage security alerts and cases using the Alert Triage Protocol.
npx skills add https://github.com/google/mcp-security --skill secops-triage
Please help me install this Agent Skill. Skill: secops-triage Source: https://github.com/google/mcp-security/tree/main/extensions/google-secops/skills/triage Command: npx skills add https://github.com/google/mcp-security --skill secops-triage
Security operations teams need a repeatable, transparent process to triage alerts and cases, identify false positives, benign true positives, and true positives, and decide when to escalate or close.
Provide an ALERT_ID or CASE_ID to begin triage of an alert or case. The skill will guide you through context gathering, duplication checks, SIEM enrichment, enrichment, and final actions.
High-intent search queries and answers about installing and using this skill.
Security alert triage requires gathering context, detecting duplicates, searching related cases, and enriching SIEM data to classify alerts as false positives, benign true positives, true positives, or suspicious results.
Standardized SOC case management applies a defined Alert Triage Protocol to guide context gathering, duplication checks, SIEM enrichment, and final actions, ensuring consistent and transparent escalation or closure decisions.
Checking for duplicate alerts involves using platform tooling like list_cases and udm_search to search existing cases, link newly surfaced alerts, and gather context before determining escalation paths.
SIEM enrichment assesses alert legitimacy by applying remote and local tooling workflows to gather context, identify related cases, and determine whether to escalate for investigation or close as a false positive.
Starting security alert triage requires providing an ALERT_ID or CASE_ID, which initiates the workflow through context gathering, duplication checks, SIEM enrichment, and final standardized actions.
dandyeTriage security alerts to distinguish real threats from false positives.
manuelbrandner85Validate suspected security vulnerabilities through data flow analysis and gate reviews.
CarbeneAIStream Wazuh SIEM alerts into a dashboard with AI-assisted analysis.
zenobi-usCoordinate incident response for security breaches and operational incidents.
