# AI SOC Alert Triage Agent

> A SOC tier-1 agent that enriches and correlates alerts, scores severity with MITRE mapping, and recommends contain, dismiss, or escalate — never auto-containing blindly.

- **Category:** Security & SecOps
- **Difficulty:** Advanced
- **Setup time:** 50 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/alert-triage-enricher

## Overview

Enrich → correlate → score → recommend: turns raw alerts into triaged, evidence-backed incidents with a clear disposition.

Context-aware severity: combines IOC reputation, asset criticality, and user/identity context — not just the raw signature — and maps to MITRE ATT&CK.

Defensive dispositions: auto-remediates only verified low-risk cases with approval, never silently dismisses likely true positives, and escalates suspected targeted activity.

Cuts alert fatigue without cutting corners: correlates duplicates into single incidents and explains every decision so analysts can trust and audit it.

## When to use it

- Your SOC is drowning in alerts and analysts spend most of their time on enrichment and obvious false positives.
- You have threat-intel, asset inventory (CMDB), and identity sources the agent can enrich from.
- You want consistent, documented tier-1 triage with MITRE mapping and an audit trail.
- You want to auto-handle verified low-risk noise while ensuring real threats reach humans fast.
- You need correlation that collapses alert storms into single incidents.

## When not to use it

- You have no enrichment sources (threat intel, asset, identity) — triage would be ungrounded.
- You expect it to run incident response and containment fully autonomously on critical assets; those need human authorization.
- You want it to make legal/compliance breach determinations — those are human and counsel decisions.
- You are unwilling to keep analyst review on dismissals and high-severity escalations.

## Architecture

- **Alert intake & normalization** — Receives alerts from the SIEM/EDR, normalizes fields (indicators, host, user, signature, time), and groups obvious duplicates before triage.
- **Enrichment fabric** — Looks up indicators against threat intel, resolves asset criticality from the CMDB, and pulls identity/behavior context — the evidence base for every decision.
- **Correlation engine** — Searches recent related alerts to detect multi-stage chains (e.g. initial access -> execution -> lateral movement) and merges them into a single incident with appropriate severity.
- **Scoring & ATT&CK mapping** — The model assigns severity and a verdict from the combined evidence and maps observed behavior to MITRE ATT&CK technique IDs for a common language.
- **Disposition & containment gate** — A deterministic gate enforces containment authority: only verified low-risk actions on non-critical assets can auto-execute; critical-asset or business-disrupting actions require human approval.
- **Case management & comms** — Creates or updates the incident case with the full evidence package and analyst note, and routes escalations to tier-2/IR with everything needed to act.
- **Feedback & detection tuning** — Logs analyst agreement/override per detection and disposition; false-positive and override rates feed detection tuning and confidence calibration.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Tune for recall on true positives above all. The cost of a missed intrusion dwarfs the cost of an extra escalation, so 'unknown/mixed evidence' must never resolve to DISMISS.
- Enforce containment authority deterministically from asset criticality. Critical/crown-jewel assets and identities can never be auto-contained; that gate lives outside the model.
- Require positive benign evidence to dismiss. Document the specific known-good indicator on every false-positive call so dismissals are auditable.
- Lead with correlation. Collapsing alert storms into single incidents is where the biggest fatigue reduction comes from — and where multi-stage attacks become visible.
- Map everything to MITRE ATT&CK. It gives analysts a shared language, makes escalations actionable, and supports detection-gap analysis.
- Backtest on labeled history before enabling any auto-action, and track missed-true-positive rate as the primary safety metric (target ~0).
- Reserve the strong model for verdict, correlation, and disposition reasoning; a cheaper model can normalize and enrich.

## Variations

- **Basic — Enrichment & triage assistant:** Enriches each alert, scores severity with MITRE mapping, and recommends a disposition with rationale for an analyst to action. No autonomous containment. The safe starting point.
- **Advanced — Auto-dispositioning with guarded containment:** Auto-dismisses evidence-backed false positives and auto-remediates verified low-risk threats on non-critical assets, with correlation into incidents and approval-gated containment for sensitive assets.
- **Enterprise — Governed SOC automation:** Adds multi-source correlation, crown-jewel policies, tier-2/IR routing, full case management and audit, detection-gap analytics, and confidence calibration driven by analyst feedback at scale.

## FAQ

**Will it isolate hosts or disable accounts automatically?**

Only for verified low-risk cases on non-critical assets, and only if you enable auto-action. Containment of critical assets or identities, or anything business-disrupting, is always proposed for analyst approval — never executed autonomously.

**How does it avoid dismissing a real threat?**

It can only mark an alert false positive with positive benign evidence (a known-good process, sanctioned scan, confirmed misconfig). Mixed or absent evidence never resolves to dismiss — it escalates. Recall on true positives is the primary tuning target.

**What does it do with a suspected targeted intrusion?**

It escalates to tier-2/IR with a full evidence package and MITRE mapping, and explicitly avoids tipping-off actions — recommending coordinated response rather than unilaterally isolating a crown-jewel asset.

**How does it reduce alert fatigue without missing things?**

By enriching with real context and correlating related alerts into single incidents, so storms collapse into one case and obvious, evidence-backed false positives are filtered — while anything uncertain still reaches a human.

**How do we trust its decisions?**

Every disposition includes the enrichment used, the correlation, a MITRE mapping, and a plain rationale, so analysts can audit and override. You also backtest it on labeled history before enabling any automation.

**How is cost managed at alert volume?**

It enriches only the indicators that could change the decision rather than querying every source for every alert, reuses enrichment already gathered, and caps tool calls — escalating with current evidence if it hits the cap.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/alert-triage-enricher
