Security team
SOC Detection & Triage
Watches the alert queue, investigates what matters, hunts proactively and tunes detection rules so the queue stays survivable, then hands recommended response to whoever executes it.
Who's on the team
- SOC LeadLead
Owns dispositions, findings and reports, and every approval gate.
- Alert Triage Analyst
Works the queue every weekday and checks for log sources that went silent.
- Detection Engineer
Tunes rules and maps coverage to ATT&CK, separating demonstrated from claimed.
- Endpoint Analyst
Investigates endpoint telemetry from SentinelOne and CrowdStrike.
- Incident Investigator
Builds timelines that mark observed and inferred facts separately.
- Perimeter Analyst
Investigates FortiGate and Proofpoint signals.
- Threat Hunter
Runs the weekly hunt and reports found, tested and clean, or could not test.
How a team arrives
- 1Import
Arrives switched off
- 2Connect
Credentials stay with you
- 3Discovery
Learns how you work
- 4You approve
Its plan and its limits
- 5Activate
Routines switch on
Controls it works inside
- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them
- It triages and investigates, and doesn't contain. Containment tools are left out of its grants.
- Read-only on Sentinel, Splunk, CrowdStrike, SentinelOne, FortiGate and Proofpoint.
- Dispositions, hunt findings, tuning and reports each pass an approval gate.
- Investigations end in a hand-off to Incident Response, not an action.
More: when and where it works, and what it documents
When it works
- Daily Alert Queue ReviewWeekdays at 08:00
- Daily Threat DigestWeekdays at 17:00
- Monthly ATT&CK Coverage AssessmentThe 1st of each month at 10:00
- Quarterly SOC Metrics ReportThe 1st of each quarter at 09:00
- Weekly Detection Tuning ReviewWednesdays at 10:00
- Weekly Hunt CycleFridays at 09:00
Routines arrive switched off. You turn each one on.
Where it works
- CrowdStrike Falcon
- FortiGate
- Entra ID (read)
- Microsoft Sentinel
- Proofpoint TAP
- SentinelOne
- ServiceNow
- Slack
- Splunk
Each connection is granted per agent, read-only or full. All integrations
What it documents
- Dispositions with reasons.
- Timelines with observed and inferred facts marked.
- Hunt results in three honest categories.
- Monthly ATT&CK coverage and a quarterly SOC metrics report.