11-csoc-automation

Name: 11-csoc-automation
Author: Masriyan

190stars37forks

How to install 11-csoc-automation?

masriyan/claude-code-cybersecurity-skill/11-csoc-automation

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 11-csoc-automation

Installs into the current project.

Summary

SOC alert triage, incident playbook automation, escalation workflows, shift reporting, and SOC KPI tracking

Files · 1

View on GitHub

SKILL.md

1	# CSOC Operations & Playbook Automation
2
3	## Purpose
4
5	Enable Claude to assist Cyber Security Operations Center (CSOC) teams with structured alert triage, automated playbook creation, escalation workflow design, shift handover reporting, and SOC metrics analysis. Claude produces operational artifacts that analysts can execute directly or adapt to their SOAR platforms.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Triaging SIEM alerts or security events
13	- Creating incident response playbooks for SOC analysts
14	- Designing escalation workflows and notification chains
15	- Generating SOC shift handover reports
16	- Calculating SOC metrics (MTTD, MTTR, FPR)
17	- Automating repetitive SOC tasks
18	- Playbook conversion to Splunk SOAR, Palo Alto XSOAR, or ServiceNow
19	- SOC analyst decision support and runbooks
20	- Alert fatigue reduction strategies
21	- Alert correlation and deduplication
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml jinja2 requests python-dateutil
29	```
30
31	Platform integrations:
32	- `Splunk SOAR` — Playbook automation
33	- `Palo Alto XSOAR` — SOAR platform
34	- `TheHive` — Open-source IR platform
35	- `ServiceNow` — ITSM ticketing
36	- `PagerDuty / OpsGenie` — Alerting and on-call
37
38	---
39
40	## Core Capabilities
41
42	### 1. Alert Triage Automation
43
44	When the user provides SIEM alerts and asks to triage:
45
46	Triage Decision Framework:
47
48	```
49	Step 1: Parse alert data
50	- Source: SIEM, EDR, WAF, IDS, email security, cloud audit logs
51	- Extract: timestamp, source IP, destination, user, process, alert type
52
53	Step 2: Asset criticality lookup
54	- Is the asset business-critical? (production DB, domain controller, payment system)
55	- Is the user privileged? (admin, developer, finance)
56	- What is the asset's network exposure?
57
58	Step 3: Threat context enrichment
59	- IP reputation: Check against blocklists (AbuseIPDB, VirusTotal, Shodan)
60	- Hash reputation: VirusTotal lookup for file hashes
61	- Domain reputation: Phishtank, URLhaus, MX Toolbox
62	- User risk score: Recent activity anomalies, recent password resets
63
64	Step 4: Apply triage matrix
65	```
66
67	Alert Triage Matrix:
68
69	\| Alert Confidence \| Asset Criticality \| Recommended Action \| SLA \|
70	\|----------------\|-------------------\|--------------------\|-----\|
71	\| High \| Critical \| Immediate escalation to Tier 2/3 — declare incident \| 15 min \|
72	\| High \| High \| Tier 1 priority investigation \| 30 min \|
73	\| High \| Medium \| Tier 1 standard investigation \| 1 hour \|
74	\| High \| Low \| Tier 1 standard queue \| 4 hours \|
75	\| Medium \| Critical \| Tier 1 priority investigation \| 30 min \|
76	\| Medium \| High \| Tier 1 standard investigation \| 2 hours \|
77	\| Medium \| Low \| Standard queue, investigate if pattern emerges \| 8 hours \|
78	\| Low \| Any \| Auto-close with documentation and note \| 24 hours \|
79
80	Triage Analysis Output Format:
81	```markdown
82	## Alert Triage Summary
83
84	Alert ID: [ID]
85	Alert Type: [Type — e.g., Brute Force Login]
86	Source: [Source IP/User/Host]
87	Time: [UTC timestamp]
88	SIEM Rule: [Rule name that triggered]
89
90	Asset Assessment:
91	- Asset: [Hostname/IP]
92	- Criticality: [Critical / High / Medium / Low]
93	- Role: [e.g., Production Database Server]
94
95	Threat Context:
96	- Source IP Reputation: [Malicious / Suspicious / Clean / Unknown]
97	- Source IP Location: [Country, ASN]
98	- Known threat actor: [Yes/No — if yes, attribution]
99	- Related IOCs found: [Yes/No]
100
101	Verdict: [True Positive / False Positive / Undetermined]
102	Triage Action: [Escalate to Tier 2 / Investigate / Close / Watch]
103	Recommended Playbook: [Playbook name]
104	Priority: [P1 Critical / P2 High / P3 Medium / P4 Low]
105
106	Analyst Notes:
107	[Notes from triage]
108	```
109
110	```bash
111	# Automated triage with script
112	python scripts/alert_triager.py --alerts alerts.json --output triage_results.json
113	python scripts/alert_triager.py --alerts siem_export.csv --playbook default --auto-assign
114	```
115
116	### 2. Incident Playbook Creation
117
118	When the user asks to create a SOC playbook:
119
120	Playbook YAML Template (SOAR-compatible):
121
122	```yaml
123	# CSOC Playbook: Phishing Email Response
124	# Compatible with: Splunk SOAR, XSOAR, TheHive
125	# Last updated: 2025-05-28
126
127	name: phishing_email_response
128	version: "2.0"
129	trigger:
130	alert_types:
131	- "Email Security - Phishing Detected"
132	- "User Reported Phishing"
133	severity: [medium, high, critical]
134
135	variables:
136	- name: sender_email
137	type: string
138	- name: recipient_email
139	type: string
140	- name: email_subject
141	type: string
142	- name: attachment_hash
143	type: string
144	required: false
145
146	tasks:
147	- id: "1-extract-artifacts"
148	name: "Extract Email Artifacts"
149	type: automated
150	actions:
151	- Extract sender, recipients, subject, body, attachments
152	- Defang all URLs and IPs found in email body
153	- Calcul

People who liked this also viewed

6 picks

Type

paperclip-create-agentCreate new agents in Paperclip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hSkillsJul 2026157k5
subagent-driven-developmentUse when executing implementation plans with independent tasks in the current sessionSkillsJul 2026154k259k
dispatching-parallel-agentsUse when facing 2+ independent tasks that can be worked on without shared state or sequential dependenciesSkillsJul 2026143k259k
browser-act-skill-forgeForges reusable Skill packages (SKILL.md + scripts) from website exploration via browser-act — no re-exploration later. Use when: user wants a reusable Skill for any website, needs to understand a sitSkillsJul 202685k4.6k
wizardGenerate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state transition — opening URLs, capturing values, confirming each stSkillsJul 202675k182k
wonda-cliUsing the Wonda CLI to generate images, videos, music, and audio from the terminal — plus LinkedIn, Reddit, and X/Twitter research and automationSkillsJul 202666k137

11-csoc-automation

190stars37forks

View on GitHub

How to install 11-csoc-automation?

masriyan/claude-code-cybersecurity-skill/11-csoc-automation

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 11-csoc-automation

Installs into the current project.

Summary

SOC alert triage, incident playbook automation, escalation workflows, shift reporting, and SOC KPI tracking

Files · 1

View on GitHub

SKILL.md

1	# CSOC Operations & Playbook Automation
2
3	## Purpose
4
5	Enable Claude to assist Cyber Security Operations Center (CSOC) teams with structured alert triage, automated playbook creation, escalation workflow design, shift handover reporting, and SOC metrics analysis. Claude produces operational artifacts that analysts can execute directly or adapt to their SOAR platforms.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Triaging SIEM alerts or security events
13	- Creating incident response playbooks for SOC analysts
14	- Designing escalation workflows and notification chains
15	- Generating SOC shift handover reports
16	- Calculating SOC metrics (MTTD, MTTR, FPR)
17	- Automating repetitive SOC tasks
18	- Playbook conversion to Splunk SOAR, Palo Alto XSOAR, or ServiceNow
19	- SOC analyst decision support and runbooks
20	- Alert fatigue reduction strategies
21	- Alert correlation and deduplication
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install pyyaml jinja2 requests python-dateutil
29	```
30
31	Platform integrations:
32	- `Splunk SOAR` — Playbook automation
33	- `Palo Alto XSOAR` — SOAR platform
34	- `TheHive` — Open-source IR platform
35	- `ServiceNow` — ITSM ticketing
36	- `PagerDuty / OpsGenie` — Alerting and on-call
37
38	---
39
40	## Core Capabilities
41
42	### 1. Alert Triage Automation
43
44	When the user provides SIEM alerts and asks to triage:
45
46	Triage Decision Framework:
47
48	```
49	Step 1: Parse alert data
50	- Source: SIEM, EDR, WAF, IDS, email security, cloud audit logs
51	- Extract: timestamp, source IP, destination, user, process, alert type
52
53	Step 2: Asset criticality lookup
54	- Is the asset business-critical? (production DB, domain controller, payment system)
55	- Is the user privileged? (admin, developer, finance)
56	- What is the asset's network exposure?
57
58	Step 3: Threat context enrichment
59	- IP reputation: Check against blocklists (AbuseIPDB, VirusTotal, Shodan)
60	- Hash reputation: VirusTotal lookup for file hashes
61	- Domain reputation: Phishtank, URLhaus, MX Toolbox
62	- User risk score: Recent activity anomalies, recent password resets
63
64	Step 4: Apply triage matrix
65	```
66
67	Alert Triage Matrix:
68
69	\| Alert Confidence \| Asset Criticality \| Recommended Action \| SLA \|
70	\|----------------\|-------------------\|--------------------\|-----\|
71	\| High \| Critical \| Immediate escalation to Tier 2/3 — declare incident \| 15 min \|
72	\| High \| High \| Tier 1 priority investigation \| 30 min \|
73	\| High \| Medium \| Tier 1 standard investigation \| 1 hour \|
74	\| High \| Low \| Tier 1 standard queue \| 4 hours \|
75	\| Medium \| Critical \| Tier 1 priority investigation \| 30 min \|
76	\| Medium \| High \| Tier 1 standard investigation \| 2 hours \|
77	\| Medium \| Low \| Standard queue, investigate if pattern emerges \| 8 hours \|
78	\| Low \| Any \| Auto-close with documentation and note \| 24 hours \|
79
80	Triage Analysis Output Format:
81	```markdown
82	## Alert Triage Summary
83
84	Alert ID: [ID]
85	Alert Type: [Type — e.g., Brute Force Login]
86	Source: [Source IP/User/Host]
87	Time: [UTC timestamp]
88	SIEM Rule: [Rule name that triggered]
89
90	Asset Assessment:
91	- Asset: [Hostname/IP]
92	- Criticality: [Critical / High / Medium / Low]
93	- Role: [e.g., Production Database Server]
94
95	Threat Context:
96	- Source IP Reputation: [Malicious / Suspicious / Clean / Unknown]
97	- Source IP Location: [Country, ASN]
98	- Known threat actor: [Yes/No — if yes, attribution]
99	- Related IOCs found: [Yes/No]
100
101	Verdict: [True Positive / False Positive / Undetermined]
102	Triage Action: [Escalate to Tier 2 / Investigate / Close / Watch]
103	Recommended Playbook: [Playbook name]
104	Priority: [P1 Critical / P2 High / P3 Medium / P4 Low]
105
106	Analyst Notes:
107	[Notes from triage]
108	```
109
110	```bash
111	# Automated triage with script
112	python scripts/alert_triager.py --alerts alerts.json --output triage_results.json
113	python scripts/alert_triager.py --alerts siem_export.csv --playbook default --auto-assign
114	```
115
116	### 2. Incident Playbook Creation
117
118	When the user asks to create a SOC playbook:
119
120	Playbook YAML Template (SOAR-compatible):
121
122	```yaml
123	# CSOC Playbook: Phishing Email Response
124	# Compatible with: Splunk SOAR, XSOAR, TheHive
125	# Last updated: 2025-05-28
126
127	name: phishing_email_response
128	version: "2.0"
129	trigger:
130	alert_types:
131	- "Email Security - Phishing Detected"
132	- "User Reported Phishing"
133	severity: [medium, high, critical]
134
135	variables:
136	- name: sender_email
137	type: string
138	- name: recipient_email
139	type: string
140	- name: email_subject
141	type: string
142	- name: attachment_hash
143	type: string
144	required: false
145
146	tasks:
147	- id: "1-extract-artifacts"
148	name: "Extract Email Artifacts"
149	type: automated
150	actions:
151	- Extract sender, recipients, subject, body, attachments
152	- Defang all URLs and IPs found in email body
153	- Calcul

People who liked this also viewed

6 picks

Type