soc-operations

SOC alert triage and shift handovers are standardized using pre-built templates and scripts to document dispositions and generate structured handover reports. This ensures consistent, audit-ready outputs for analysts transitioning between shifts.

Tracking SOC KPIs like MTTD and MTTR is handled by operational reporting scripts that calculate metrics such as mean time to detect, mean time to respond, and false positive rates. This produces consistent metrics reports for performance evaluation.

No external Python libraries are needed to automate security operations workflows. The tool requires Python 3.9 or higher and relies entirely on the standard library, using provided scripts, reference materials, and templates to function.

Yes, you can document indicators of compromise during security alert investigations. The tool includes IOC documentation features that allow SOC analysts to track indicators within standardized triage templates during active investigations.

Shift handover report generation for security operations is done using the ShiftHandover script. It takes ongoing investigation details and outputs a structured handover report for seamless transitions between SOC analysts, ensuring no context is lost.

You can triage common security alert types using pre-built triage templates. The AlertTriage script allows SOC analysts to document security alerts with standardized dispositions, ensuring consistent and audit-ready outputs across various alert categories.