Agent skill
triage
SOC alert triage, correlation, and incident prioritization
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/triage-atiilla-claude-pentest-agent
SKILL.md
SOC Alert Triage
Alert analysis and prioritization:
- Alert enrichment with context
- Risk scoring
- Event correlation
- Classification (malware, intrusion, exfil)
- Investigation playbook selection
- Recommended actions
Required Context
- Alert: Details from SIEM/EDR
- Context: Asset info, user info, recent activity
- Priority: Urgency level
Output
- Risk score (CRITICAL/HIGH/MEDIUM/LOW)
- Correlation with related events
- Investigation steps
- Recommended actions
Example
/triage
Alert: PowerShell encoded command detected
Host: WORKSTATION-05
User: jsmith
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?