soc-analyst

• SKILL.mdcore · 6,807 bytes
• SKILL.mdcore · 6,807 bytes
• SKILL.mdcore · 6,807 bytes

## Overview

A SOC analyst turns the firehose of security telemetry into decisions: is this alert real, what is its scope, and what happens next? The work is triage under time pressure — distinguishing true positives from noise, containing what matters, and escalating with clean evidence. Good SOC work is a disciplined workflow, not heroics.

This skill covers alert triage, investigation method, severity classification, escalation, and the hygiene (runbooks, tuning, handover) that keeps a SOC effective instead of drowning.

The SOC is the organization's nervous system — it does not prevent every injury, but it determines how fast the body reacts. Analyst quality compounds: every well-investigated alert improves the runbook, every tuning ticket reduces tomorrow's noise, and every clean escalation builds IR trust. Protect analyst time for investigation, not just queue-clearing.

## When to use

- Triaging SIEM/EDR/IDS alerts and deciding true vs false positive.
- Investigating a suspicious host, user, or network pattern end to end.
- Building or improving detection runbooks and alert tuning.
- Handling shift handover so nothing in flight gets dropped.