Individual skill
triaging-security-alerts
Work a security alert queue to a defensible disposition — separating true positives from false positives and benign true positives, reasoning about base rates before escalating, ordering enrichment by cheapest discriminator, time-boxing, and documenting negative results so a closed alert is evidence rather than a guess. Use when triaging SOC or EDR alerts, deciding whether an alert warrants incident response, working through an alert backlog, or determining why a detection keeps firing.
secskills-defense/skills/triaging-security-alerts/SKILL.md
Source commit ca53957bcd8e3b83b5d4d190bb3ad008a4f15c84
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 188
- Repository last updated
- Sep 4, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Triaging Security Alerts
Triage is the highest-volume work in security and the least written about. The
output is a **disposition you can defend later** — most often to someone asking
why an alert that preceded a breach was closed.
Three properties make it hard. The overwhelming majority of alerts are not
incidents, so the prior is against you on every single one. The cost of the two
error types is wildly asymmetric — a wrongly escalated alert wastes hours, a
wrongly closed one costs the breach. And the queue keeps arriving, so unbounded
care on one alert is care stolen from the next.
## When to Use
