skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

soc-analyst

Guides security analysts through alert triage, incident investigation, and escalation workflows.

Updated Jun 5, 2026
Search Tags:#incident response#security operations#mitre att&ck#alert triage#threat investigation#soc analyst#ioc extraction
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill soc-analyst-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: soc-analyst
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/soc-analyst
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill soc-analyst-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security and SOC analysts face alert fatigue, unclear prioritization, and inconsistent investigation quality. This Skill provides a principles-first mindset and structured approach for triaging alerts, reconstructing attack timelines, and communicating findings effectively. ## Core Features & Use Cases - Triage & Prioritization: Classify alerts as true positive, false positive, benign positive, or unknown, and prioritize by business impact using a CRITICAL-to-LOW matrix. - Hypothesis-Driven Investigation: Structure investigations around hypotheses, map attacker behavior to Cyber Kill Chain and MITRE ATT&CK phases, and extract IoCs for hunting and blocking. - Communication & Escalation: Apply audience-appropriate language guidelines for technical teams versus management, with clear escalation thresholds and blameless post-mortem practices. - Use Case: An analyst receives 50 SIEM alerts overnight. Use this Skill to triage by impact, form hypotheses for the top alerts, correlate EDR and network logs, build a timeline, and escalate a confirmed brute-force attempt with concrete IoCs. ## Quick Start Help me triage these SIEM alerts and build an investigation plan for the suspicious login activity.

Frequently Asked Questions about soc-analyst

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage security alerts from a SIEM effectively?▼

Classify each alert as true positive, false positive, benign positive, or unknown, then prioritize by business impact using a CRITICAL-to-LOW matrix. Focus investigation depth on high-impact alerts and refine rules that generate frequent false positives.

What is hypothesis-driven investigation in a SOC?▼

Hypothesis-driven investigation starts with a specific theory, such as credential stuffing or malware, which determines what data to check and which tools to use. This avoids drowning in all available data and prevents paralysis by analysis.

How do I map an attack to MITRE ATT&CK during an investigation?▼

Reconstruct the attack chronologically from initial access through exfiltration, then map observed attacker behaviors to MITRE ATT&CK tactics and techniques. This reveals which phase you detected the attack in and what earlier stages were missed.

When should a SOC analyst escalate an incident?▼

Escalate when an incident exceeds defined severity thresholds, such as confirmed unauthorized access or critical system impact, and include enough context for the recipient to act immediately. Escalation is a request for help, not a transfer of responsibility.

What are the limitations of a mindset-focused SOC skill?▼

This Skill provides investigation principles and communication frameworks, not tool-specific guidance like SIEM query syntax or EDR configuration. For technical implementation details, use dedicated tooling or platform-specific skills instead.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
marquesfelipmarquesfelip

incident-response-playbooks

Standardize incident response workflows from detection to post-mortem.

Community
Advanced
dandyedandye
120

hunt-apt

Integrate threat actor profiles and intelligence to locate and report on IoCs and MITRE techniques in real-time network traffic.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced