performing-alert-triage-with-elastic-siem
mukul975/Anthropic-Cybersecurity-Skills
This guide provides a systematic, step-by-step workflow for Security Operations Center (SOC) analysts to perform alert triage using Elastic Security SIEM. It covers initial alert assessment, context gathering using advanced ES|QL queries, threat intelligence enrichment, and final classification decisions (True Positive, False Positive, etc.) to rapidly determine genuine security threats and prioritize incident response actions.