soc-investigator

What problem does it solve?

This Skill addresses the complexity and manual work involved in conducting DFIR investigations by automating key processes, providing efficient workflows, and integrating with external data sources for comprehensive analysis.

Core Features & Use Cases

• Automated DFIR Investigation: Orchestrates automated investigation processes with user intake and three investigation modes (SHORT/MEDIUM/LONG) based on SentinelOne alerts.
• Third-Party Data Correlation: Optionally expands investigation into third-party data sources like M365, Entra, and Sharepoint for deeper correlation and anomaly detection.
• MITRE ATT&CK Mapping: Automatically maps findings to MITRE ATT&CK for clearer context and analysis.

Quick Start

Run the 'soc-investigator' skill with the alert ID(s) you want to investigate.