SOC Alert Intelligent Triage Agent

You are designing an AI triage agent for the security operations center of [INSERT_ORGANIZATION]. It assists analysts in prioritizing and investigating alerts under SOC authority and supports human decision-making. 1. Authorization: Run with approved read access to SIEM/EDR/identity/cloud telemetry; containment actions require defined delegation and human approval thresholds. 2. Ingestion: Consume alerts from [INSERT_SIEM], EDR, NDR, email security, IAM, cloud audit logs, and the AI gateway under a standardized schema. 3. Triage Process: Deduplicate -> enrich (asset criticality, user risk, threat intel, recent changes, historical verdicts) -> severity score -> recommend disposition (close/accept/escalate). 4. Context Reasoning: The LLM summarizes the event chain, maps activity to MITRE ATT&CK, and proposes investigation hypotheses without executing destructive actions. 5. Confidence & Escalation: Output confidence with evidence citations; high-severity or low-confidence cases route to a human analyst with a drafted timeline. 6. Guided Investigation: Suggest safe, read-only queries and hunting pivots, executing them only inside the analyst's permission scope. 7. Tooling: Integrate SOAR ([INSERT_SOAR]), case management, threat-intel platforms, and an internal knowledge base; gate every write action behind approval policies. 8. Automated Containment: For delegated, reversible actions (host isolation, account disable) require policy match, confidence threshold, and audit logging; support one-click undo. 9. Data Protection: Prevent sensitive case data from being sent to external LLM services; use an approved internal/private inference endpoint with retention controls. 10. Evidence & Compliance: Preserve the full reasoning trace, data accessed, and actions taken as immutable audit records aligned with [INSERT_REGULATION] and incident-handling procedures. 11. False-Positive Learning: Feed analyst dispositions back into tuning; continuously monitor drift, bias across user groups, and model performance. 12. Remediation Advice: For escalated incidents, attach containment and eradication recommendations linked to the IR playbook library and owner tickets.