About soc-analyst
A skill for security operations center analysts who triage and investigate alerts from SIEM, EDR, email, cloud, and identity systems. It guides playbook-based enrichment and documentation, with escalation to CSIRT when incident criteria are met.
Key features
- 01Triage alerts from multiple security sources
- 02Enrich alerts with threat and asset context
- 03Run tier-one and tier-two playbooks
- 04Document investigations and close alerts by procedure
- 05Escalate to CSIRT when criteria are met
Use cases
- 01Investigate SIEM or EDR alerts
- 02Add asset, user, and threat-intelligence context to alerts
- 03Handle false positives or remediable true positives under playbooks
- 04Refer findings meeting incident criteria to CSIRT
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/soc-analystin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/alert_triage_and_classification.mdcontainment_escalation_handoff.mddetection_feedback_and_metrics.mdioc_enrichment_and_investigation.mdsiem_soar_playbooks.mdsoc_analyst_scope.mdDetails
From the project READMESOC Analyst
When to Use
- Triage and investigate SIEM, EDR, email, cloud, and identity alerts
- Execute tier-1/tier-2 playbooks and document findings
- Enrich alerts with threat intel, asset context, and user/account data
- Close benign or true-positive-with-remediation alerts per runbook
- Escalate to CSIRT when incident criteria are met
When NOT to Use
- Declare incidents, lead containment, or draft regulatory comms →
incident-responder - Design SEV levels, on-call, paging, or postmortem program →
incident-management-engineer - Plan or execute red team campaigns (operator role) →
red-team-specialist - Implement SIEM/EDR or IAM controls →
information-security-engineer - Hypothesis-driven threat hunts and hunt campaigns →
threat-hunter - Disassembly, decompilation, patch diff, or malware RE lab work →
reverse-engineer
Related skills
| Need | Skill |
|---|---|
| Escalate declared security incident | incident-responder |
| Incident program, escalation matrix | incident-management-engineer |
| Security strategy and IR policy | cybersecurity |
| Red team / purple team exercise design | red-team-specialist |
| Tooling implementation (SIEM, EDR, SOAR) | information-security-engineer |
| Cloud audit and account forensics | cloud-security-engineer |
| Proactive threat hunts and hunt campaigns | threat-hunter |
| Detection tuning and DFIR-style investigation | defensive-security-analyst |
| Disk/memory forensics and chain of custody | digital-forensics-analyst |
| Binary/protocol RE, patch diff, YARA from samples | reverse-engineer |
| Vetted IOC/TTP packages and tactical intel for enrichment | cti-analyst |
Handoff to threat hunting
Escalate to threat-hunter when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.
Handoff to CSIRT
Escalate to incident-responder when incident declaration criteria are met (see incident-responder/references/incident_declaration_and_severity.md). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.