SOC alert triage: an AI workflow for EDR and SIEM alerts
The EDR fires on a Finance laptop: Word spawned PowerShell with an encoded command, then the machine connected to an IP your intel feed flagged this week. On the same shift, a build server and the vulnerability scanner will raise a dozen alerts that look just as alarming and mean nothing.
This workflow runs the asset lookup and the intel lookup side by side, then hands both to a cheap tier-1 pass. Known benign sources close with a short note and a narrow tuning idea. Everything else escalates to a stronger model that writes the timeline, ATT&CK techniques and containment steps, and the run waits for an analyst before the host is isolated.
Free in Sim. No account or API key.
Sample input
EDR alert, high: WINWORD.EXE spawned powershell.exe with an encoded command on FIN-LT-0442, then an outbound connection to 198.51.100.23:443. The user opened an emailed invoice two minutes earlier. True positive? Isolate the host?
How the workflow runs, step by step
1. Start
SIEM alert
The alert from your SIEM or EDR starts the run.
Next: Asset lookup, Threat intel
2. Tool
Asset lookup
Searches your asset list for the host: owner, criticality and whether isolation is allowed. It stands in for your CMDB.
Next: Enrichment
3. Tool
Threat intel
Searches your intel notes for the IPs and behaviour in the alert, with ATT&CK mappings.
Next: Enrichment
4. Join
Enrichment
Waits for both lookups and passes them on together.
Next: Tier-1 triage
5. Agent
Tier-1 triage
A small model classifies the alert as a true positive, benign or false positive, using only the alert and the enrichment.
Next: Disposition
6. Router
Disposition
Keyword rules close known benign sources such as the build account or the scanner. Everything else escalates, which is the safe default.
Next: Incident write-up (escalate), Close-out note (benign)
7. Agent
Incident write-up
A stronger model writes the escalation: timeline, ATT&CK techniques, scope, containment and the evidence to keep.
Next: Approve isolation
8. Human approval
Approve isolation
The run pauses. An analyst approves before the host is isolated or the user's password is reset.
Next: Escalation
9. Result
Escalation
The approved escalation, ready for your case system or Slack.
10. Agent
Close-out note
For benign alerts, a cheap model writes why it is safe and one narrowly scoped suppression idea.
Next: Alert closed
11. Result
Alert closed
The close-out note ends the run. No escalation and no human step.
Why build it as a graph
Alert volume is the problem in most SOCs, not any single alert. A graph lets the cheap steps handle the volume and keeps the strong model and the analyst for real incidents. Each lookup, decision and approval is a step you can inspect, which helps when someone asks later why an alert was closed.
Things to try
- Run the sample in Sim. Both lookups run at once, tier 1 escalates, and the run pauses before isolation.
- Paste “encoded PowerShell on BUILD-07 run by svc-build at 02:00” and run again. The same graph closes it as benign.
- Compare the cost per step: enrichment and tier 1 are cheap, and the incident write-up only runs when there is an incident.