Triage security alerts to distinguish real threats from false positives.
npx skills add https://github.com/dandye/ai-runbooks --skill triage-alert
Please help me install this Agent Skill. Skill: triage-alert Source: https://github.com/dandye/ai-runbooks/tree/main/skills/triage-alert Command: npx skills add https://github.com/dandye/ai-runbooks --skill triage-alert
This skill standardizes the initial assessment of security alerts to determine if they represent real threats requiring investigation or can be closed as false positives.
Triage the alert CASE_ID=1234 to determine whether to close or escalate.
High-intent search queries and answers about installing and using this skill.
Automate security alert triage by retrieving alert details, extracting indicators, performing GTI enrichment, and checking for duplicates to classify alerts. This standardized initial assessment quickly distinguishes false positives from true threats, reducing mean time to decision.
Distinguish false positives in a SIEM by applying automated enrichment and correlation against alert indicators. Searching for related open cases and performing duplicate checks provides the documented rationale needed to close benign events.
Yes, you can escalate security cases automatically. When triage classifies an alert as a true positive or suspicious, it triggers relevant runbooks and escalates to Tier 2 with documented rationale and evidence for seamless handoff.
Yes, alert triage requires specific inputs like ALERT_ID or CASE_ID to start. The deterministic execution uses these identifiers to query SIEM and SOAR interfaces, retrieving full details and key indicators for context gathering.
Use automated triage to standardize initial alert assessment and maintain an auditable workflow. It eliminates repetitive manual correlation by automatically discovering duplicates and related cases, ensuring clear escalation status with supporting evidence.
dandyeCorrelate IOC lists against SIEM alerts and SOAR cases.
UnitOneAITriage security alerts through four-phase evidence collection and disposition classification.
dandyeAggregate GTI reports, SIEM findings, and related entities for a single IOC.
jassicsAutomate SIEM/EDR alert triage with validation, enrichment, and verdict decisions.
