# Examples — AI SOC Alert Triage Agent

## Commodity malware on a non-critical endpoint → auto-remediate (with approval)

EDR flags a known malware hash on a standard laptop. Enrichment confirms it's a verified commodity threat on a non-critical asset — a safe candidate for fast remediation.

**Input**

```
Alert: EDR detection 'Win.Trojan.GenericKD' hash a1b2c3... on host LT-4471 (user: contractor laptop).
```

**Output**

```
{
  "alert_id": "EDR-99812",
  "severity": "medium",
  "confidence": 0.9,
  "verdict": "true_positive",
  "mitre": ["T1204 User Execution"],
  "enrichment": { "iocs": ["hash a1b2c3 = known commodity trojan, 41/64 vendors, first seen 2024"], "asset_criticality": "low (standard endpoint, no sensitive data)", "identity_context": "contractor, no admin rights, no recent privileged activity" },
  "correlation": "none — single isolated detection, no related alerts in the last 24h",
  "disposition": "AUTO_REMEDIATE",
  "actions": [ { "tool": "contain_host", "args": { "host": "LT-4471", "action": "quarantine", "scope": "non_critical_endpoint" }, "requires_approval": true } ],
  "rationale": "Verified commodity malware (high vendor consensus) on a low-criticality endpoint with a non-privileged user and no correlated activity. Low blast radius; quarantine + reimage is the standard safe response.",
  "analyst_note": "Quarantine LT-4471 and reimage; reset the contractor's session creds as hygiene. No signs of spread.",
  "escalation": { "needed": false, "tier": "none", "reason": "" }
}
```

**Note:** A clean true positive the SOC wants handled fast — but note containment is still flagged requires_approval=true by default, and would only auto-execute if 'act' mode is on AND the asset is non-critical. The verdict is grounded in vendor consensus, asset criticality, and the lack of correlation.

## Correlated credential-stuffing → one incident, recommend response

Dozens of 'failed login' alerts look like noise individually. Correlation reveals a single distributed attack — the agent collapses them and recommends action.

**Input**

```
Alerts: 60+ failed-login alerts across 30 accounts in 8 minutes from a rotating set of IPs, then 2 successful logins.
```

**Output**

```
{
  "alert_id": "CLUSTER-2207",
  "severity": "high",
  "confidence": 0.82,
  "verdict": "true_positive",
  "mitre": ["T1110.004 Credential Stuffing", "T1078 Valid Accounts"],
  "enrichment": { "iocs": ["source IPs across 14 ASNs, several on auth-abuse intel lists"], "asset_criticality": "medium (customer-facing auth)", "identity_context": "2 accounts now show successful login from new geo/device after the burst" },
  "correlation": "60+ failed logins + 2 successes form one credential-stuffing campaign — merged into a single incident.",
  "disposition": "RECOMMEND",
  "actions": [
    { "tool": "create_incident", "args": { "title": "Credential stuffing with 2 likely-compromised accounts", "severity": "high" }, "requires_approval": false },
    { "tool": "contain_host", "args": { "action": "force_password_reset+session_revoke", "targets": ["acct_A", "acct_B"] }, "requires_approval": true }
  ],
  "rationale": "Distributed failed logins followed by anomalous successful logins on 2 accounts is classic credential stuffing with probable compromise. Customer-facing auth raises severity; account actions need analyst approval.",
  "analyst_note": "Approve forced reset + session revoke for acct_A/acct_B, enable step-up auth, and consider temporary rate-limiting on the auth endpoint.",
  "escalation": { "needed": false, "tier": "none", "reason": "" }
}
```

**Note:** The value here is correlation: 60+ alerts that would each be dismissed as noise become one high-severity incident. The agent recommends account containment but marks it approval-required because forced resets affect real users — it doesn't unilaterally lock customers out.

## Suspected lateral movement on a domain controller → escalate, don't touch

Weak-but-worrying signals on a crown-jewel asset. The agent resists both dismissing it and taking a risky containment action that could tip off an adversary.

**Input**

```
Alert: unusual SMB + remote-service-creation activity from a workstation to DC-01 (domain controller), outside business hours, by an account that normally never touches DCs.
```

**Output**

```
{
  "alert_id": "EDR-99877",
  "severity": "critical",
  "confidence": 0.55,
  "verdict": "suspicious",
  "mitre": ["T1021.002 SMB/Admin Shares", "T1543.003 Create/Modify Service", "T1570 Lateral Tool Transfer"],
  "enrichment": { "iocs": ["no known-bad hash yet; behavior-based"], "asset_criticality": "critical (domain controller / crown jewel)", "identity_context": "service-desk account, never historically authenticates to DCs, off-hours" },
  "correlation": "Possible early lateral movement; checking for prior initial-access alerts on the source workstation.",
  "disposition": "ESCALATE",
  "actions": [ { "tool": "escalate_to_tier2", "args": { "tier": "IR", "priority": "critical" }, "requires_approval": false } ],
  "rationale": "Anomalous remote service creation toward a domain controller by an account that never touches DCs, off-hours, maps to lateral-movement techniques. On a crown-jewel asset this is treated as a potential targeted intrusion despite moderate confidence.",
  "analyst_note": "Do NOT auto-isolate the DC or disable the account yet — risk of tipping off the actor and of disrupting the domain. Recommend IR coordinate: capture volatile evidence on source + DC, scope the account's recent activity, then contain in a planned way.",
  "escalation": { "needed": true, "tier": "IR", "reason": "Suspected targeted lateral movement toward a domain controller; crown-jewel asset; potential intrusion." }
}
```

**Note:** The flagship-defining case: confidence is only 0.55, but because the target is a domain controller and the behavior maps to lateral movement, the agent escalates to IR as critical rather than dismissing. Crucially, it explicitly recommends NOT auto-containing — isolating a DC or disabling the account could disrupt the domain and tip off an adversary. It surfaces evidence and defers the response plan to humans.
