# Workflow — AI SOC Alert Triage Agent

## 1. 1. Intake and dedup

Pull the alert from the SIEM/EDR, normalize its fields, and group obvious duplicates so a storm becomes one case.

## 2. 2. Enrich the evidence

Enrich the indicators that matter (IOC reputation, asset criticality, identity context) — only the ones that could change the decision.

## 3. 3. Correlate

Search recent related alerts for a multi-stage chain; if found, merge into one incident and raise severity to match the bigger picture.

## 4. 4. Score and map

Assign severity and a verdict from the combined evidence and map observed behavior to MITRE ATT&CK technique IDs.

## 5. 5. Decide the disposition

Auto-remediate only verified low-risk true positives on non-critical assets; dismiss only with positive benign evidence; otherwise recommend or escalate.

## 6. 6. Act through the gate

The containment gate executes only allow-listed low-risk actions; critical-asset or disruptive actions are staged for analyst approval with the evidence attached.

## 7. 7. Document and learn

Create/update the case with the full package, route escalations to tier-2/IR, and log analyst agreement to tune detections and confidence.
