soc-analyst

Triage SOC alerts by applying structured enrichment and correlation to SIEM and EDR data. This skill guides you through decision points, playbook execution, and case documentation to generate escalation recommendations with auditable UTC timestamps.

Document incident handoffs by generating a concise handoff narrative with structured analyst notes and linked evidence. This ensures that escalation decisions and context are consistently transferred to the incident response team.

SOC case management works by applying structured enrichment and correlation to alerts, creating auditable case documentation. It uses playbooks to guide investigation steps and generate escalation recommendations for incident response.

Yes, you can use the investigation output for detection tuning feedback. The skill includes a flow aligned with runbooks and postmortem learnings to refine future alert triggers and reduce false positives.

No specific SIEM or EDR platform dependencies are required. The skill provides platform-agnostic guidance for triage, investigation, and handoff, using structured templates to document evidence and escalation decisions.

UTC timestamps are important because they ensure all triage steps, enrichment data, and escalation decisions are auditable. This standardizes the timeline of events across global security operations and incident response teams.