# Setup guide — AI SOC Alert Triage Agent

## 1. Install and connect sources

Install the agent and connect it (read-only for enrichment) to your SIEM/EDR, threat intel, CMDB, and identity provider.

```
pipx install soc-triage-agent
soc-triage-agent connect --siem splunk --edr crowdstrike --intel virustotal --cmdb servicenow --idp okta
soc-triage-agent doctor
```

## 2. Set containment authority and caps

Define what may auto-contain. Critical assets are never autonomous. Limits are enforced outside the model.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
SIEM_TOKEN=...
INTEL_TOKEN=...
MAX_TOOL_CALLS=8
MODE=advise   # advise (recommend only) | act (auto low-risk)
```

## 3. Classify critical assets

Tell the agent which assets/identities are crown jewels so it never auto-contains them.

```
# .soc.yml
critical_assets:
  - "domain-controllers/*"
  - "prod-db/*"
  - "finance/*"
auto_contain_allowed:
  - scope: "non_critical_endpoint"
    when: "verified_commodity_malware"
never_dismiss_without: "benign_evidence"
```

## 4. Backtest on historical alerts

Replay labeled past alerts to measure true/false-positive handling before going live.

```
soc-triage-agent backtest --range 30d --explain
# reports verdict accuracy, FP reduction, and any missed true positives (must be ~0)
```

## 5. Wire into the SIEM as tier-1

Route new alerts to the agent for triage. Start in advise mode (recommends only), enable act mode for allow-listed low-risk containment once backtests look clean.

```
# SIEM webhook -> POST https://your-host/soc/alert (HMAC)
# Promote MODE=act only after a clean backtest with zero missed true positives
```
