Skill UI

Guides SOC analysts through initial triage of SIEM/EDR alerts using NIST SP 800-61r3 and SANS PICERL, classifying incidents, assessing severity via impact matrices, enriching with threat and asset context, and escalating to the right response team with containment steps.

Implement kernel-level eBPF security monitoring via Cilium Tetragon, covering TracingPolicy CRDs, kprobes/tracepoints, in-kernel filtering, JSON event export, and SIEM integration for Linux hosts or Kubernetes clusters.