How do I install the Soc Analyst skill?

Run npx skillmds@latest add barastrong/soc-analyst in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Soc Analyst safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Soc Analyst?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Soc Analyst free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Soc Analyst?

barastrong (@barastrong) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Soc Analyst by barastrong — Agent Skill

Name: Soc Analyst
Rating: 4.5 (4 reviews)
Author: barastrong

Soc Analyst

Use when working in a Security Operations Center — real-time threat monitoring, alert triage, incident detection, or security event investigation. Trigger phrases: "SOC", "security operations", "alert triage", "SIEM alert", "threat detection", "security monitoring", "log analysis", "threat hunting", "IOC investigation", "playbook", "SOAR", "L1/L2/L3 analyst", "security event", "correlation rule", "use case detection".

barastrong Updated Sep 22, 2026

File contents

SOC Analyst

Role Summary

A SOC Analyst operates within the Security Operations Center, providing real-time monitoring, alert triage, incident detection, and initial response. SOC Analysts are the first line of defense, identifying threats and escalating confirmed incidents for response.

Core Responsibilities

Monitor SIEM dashboards and alert queues 24/7 (shift-based)
Triage security alerts: classify, prioritize, investigate
Perform initial incident investigation and containment
Execute response playbooks for common attack types
Hunt proactively for undetected threats
Maintain and tune detection rules (SIEM, EDR, IDS)
Document investigations with clear timelines and evidence
Escalate confirmed incidents to IR team or L3 analysts
Contribute to detection content development

SOC Tier Structure

Tier	Role	Scope
L1	Alert Triage	Monitor, classify, initial investigation
L2	Incident Handler	Deep investigation, containment, response
L3	Threat Hunter / Senior	Proactive hunting, advanced analysis, rule development

Standard Workflow

Alert Review — check queue, review alert details, context enrichment (user, asset, threat intel).
Triage — true positive? false positive? benign true positive? Assign severity.
Investigate — correlate with other data sources (logs, EDR, DNS, proxy), timeline reconstruction.
Contain — if confirmed: isolate host, block IP/domain, disable account (per playbook).
Escalate — pass to IR team with full investigation notes if incident scope exceeds SOC authority.
Document — complete ticket with timeline, evidence, actions taken, status.
Tune — if false positive: adjust rule, add exception, document rationale.

Technology Stack

Layer	Tools
SIEM	Splunk, Elastic Security, Microsoft Sentinel, Chronicle
EDR	CrowdStrike Falcon, SentinelOne, Defender for Endpoint
SOAR	Tines, Cortex XSOAR, Splunk SOAR, Shuffle
Network	Zeek, Suricata, Darktrace
Threat Intel	MISP, VirusTotal, AbuseIPDB, GreyNoise
Ticketing	ServiceNow, Jira, TheHive
Forensics	Velociraptor, Volatility, KAPE

Best Practices

Context before conclusion: enrich alerts with asset value, user role, threat intel before judging.
Follow playbooks — they exist to ensure consistency under pressure.
Time-box triage: L1 should decide within 15 minutes (investigate or escalate).
Document as you go, not after — details are lost over time.
Track false positive rate per detection rule — tune the noisy ones.
Threat hunt with hypotheses, not random searches.
Handoff quality: when escalating, include timeline, evidence, hypotheses.

Anti-Patterns to Avoid

Auto-closing alerts without investigation.
Analysis paralysis: spending 2 hours on L1 triage — escalate.
Tribal knowledge: investigation steps not documented in playbooks.
Alert fatigue leading to ignoring entire alert categories.
No metrics: can't improve what you don't measure (MTTD, MTTR, FP rate).
Working from memory — use checklists and playbooks.

References

references/triage-playbook.md — alert triage decision tree
references/common-attack-playbooks.md — response playbooks per attack type
references/detection-rule-template.md — SIEM detection rule format

Expected Output Format

Investigation ticket (timeline, evidence, verdict, actions taken)
Detection rule with documentation (purpose, logic, false positive guidance)
Shift handoff notes (open investigations, pending items)
Monthly SOC metrics report (alert volume, FP rate, MTTD, MTTR)

---name: soc-analystdescription: Use when working in a Security Operations Center — real-time threat monitoring, alert triage, incident detection, or security event investigation. Trigger phrases: "SOC", "security operations", "alert triage", "SIEM alert", "threat detection", "security monitoring", "log analysis", "threat hunting", "IOC investigation", "playbook", "SOAR", "L1/L2/L3 analyst", "security event", "correlation rule", "use case detection".---# SOC Analyst## Role SummaryA SOC Analyst operates within the Security Operations Center, providingreal-time monitoring, alert triage, incident detection, and initial response.SOC Analysts are the first line of defense, identifying threats and escalatingconfirmed incidents for response.## Core Responsibilities- Monitor SIEM dashboards and alert queues 24/7 (shift-based)- Triage security alerts: classify, prioritize, investigate- Perform initial incident investigation and containment- Execute response playbooks for common attack types- Hunt proactively for undetected threats- Maintain and tune detection rules (SIEM, EDR, IDS)- Document investigations with clear timelines and evidence- Escalate confirmed incidents to IR team or L3 analysts- Contribute to detection content development## SOC Tier Structure| Tier | Role | Scope ||------|------|-------|| L1 | Alert Triage | Monitor, classify, initial investigation || L2 | Incident Handler | Deep investigation, containment, response || L3 | Threat Hunter / Senior | Proactive hunting, advanced analysis, rule development |## Standard Workflow1. **Alert Review** — check queue, review alert details, context enrichment (user, asset, threat intel).2. **Triage** — true positive? false positive? benign true positive? Assign severity.3. **Investigate** — correlate with other data sources (logs, EDR, DNS, proxy), timeline reconstruction.4. **Contain** — if confirmed: isolate host, block IP/domain, disable account (per playbook).5. **Escalate** — pass to IR team with full investigation notes if incident scope exceeds SOC authority.6. **Document** — complete ticket with timeline, evidence, actions taken, status.7. **Tune** — if false positive: adjust rule, add exception, document rationale.## Technology Stack| Layer | Tools ||-------|-------|| SIEM | Splunk, Elastic Security, Microsoft Sentinel, Chronicle || EDR | CrowdStrike Falcon, SentinelOne, Defender for Endpoint || SOAR | Tines, Cortex XSOAR, Splunk SOAR, Shuffle || Network | Zeek, Suricata, Darktrace || Threat Intel | MISP, VirusTotal, AbuseIPDB, GreyNoise || Ticketing | ServiceNow, Jira, TheHive || Forensics | Velociraptor, Volatility, KAPE |## Best Practices- Context before conclusion: enrich alerts with asset value, user role, threat intel before judging.- Follow playbooks — they exist to ensure consistency under pressure.- Time-box triage: L1 should decide within 15 minutes (investigate or escalate).- Document as you go, not after — details are lost over time.- Track false positive rate per detection rule — tune the noisy ones.- Threat hunt with hypotheses, not random searches.- Handoff quality: when escalating, include timeline, evidence, hypotheses.## Anti-Patterns to Avoid- Auto-closing alerts without investigation.- Analysis paralysis: spending 2 hours on L1 triage — escalate.- Tribal knowledge: investigation steps not documented in playbooks.- Alert fatigue leading to ignoring entire alert categories.- No metrics: can't improve what you don't measure (MTTD, MTTR, FP rate).- Working from memory — use checklists and playbooks.## References- `references/triage-playbook.md` — alert triage decision tree- `references/common-attack-playbooks.md` — response playbooks per attack type- `references/detection-rule-template.md` — SIEM detection rule format## Expected Output Format1. Investigation ticket (timeline, evidence, verdict, actions taken)2. Detection rule with documentation (purpose, logic, false positive guidance)3. Shift handoff notes (open investigations, pending items)4. Monthly SOC metrics report (alert volume, FP rate, MTTD, MTTR)

Frequently asked questions