# SOC Detection & Triage

URL: https://avispa.ai/agent-teams/soc-detection-triage/

Security team

Watches the alert queue, investigates what matters, hunts proactively and tunes detection rules so the queue stays survivable, then hands recommended response to whoever executes it.

## Who's on the team

- **SOC Lead** · Lead · Owns dispositions, findings and reports, and every approval gate.
- **Alert Triage Analyst** · Works the queue every weekday and checks for log sources that went silent.
- **Detection Engineer** · Tunes rules and maps coverage to ATT&CK, separating demonstrated from claimed.
- **Endpoint Analyst** · Investigates endpoint telemetry from SentinelOne and CrowdStrike.
- **Incident Investigator** · Builds timelines that mark observed and inferred facts separately.
- **Perimeter Analyst** · Investigates FortiGate and Proofpoint signals.
- **Threat Hunter** · Runs the weekly hunt and reports found, tested and clean, or could not test.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- It triages and investigates, and doesn't contain. Containment tools are left out of its grants.
- Read-only on Sentinel, Splunk, CrowdStrike, SentinelOne, FortiGate and Proofpoint.
- Dispositions, hunt findings, tuning and reports each pass an approval gate.
- Investigations end in a hand-off to Incident Response, not an action.

**More: when and where it works, and what it documents**

## When it works

- **Daily Alert Queue Review** · Weekdays at 08:00
- **Daily Threat Digest** · Weekdays at 17:00
- **Monthly ATT&CK Coverage Assessment** · The 1st of each month at 10:00
- **Quarterly SOC Metrics Report** · The 1st of each quarter at 09:00
- **Weekly Detection Tuning Review** · Wednesdays at 10:00
- **Weekly Hunt Cycle** · Fridays at 09:00

Routines arrive switched off. You turn each one on.

## Where it works

- CrowdStrike Falcon
- FortiGate
- Entra ID (read)
- Microsoft Sentinel
- Proofpoint TAP
- SentinelOne
- ServiceNow
- Slack
- Splunk

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- Dispositions with reasons.
- Timelines with observed and inferred facts marked.
- Hunt results in three honest categories.
- Monthly ATT&CK coverage and a quarterly SOC metrics report.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: Software Engineering](https://avispa.ai/agent-teams/software-engineering/)

## Onboard SOC Detection & Triage with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)