Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.
---
name: full-alert-triage
description: "Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing."
type: workflow
orchestrates:
- check-duplicates
- triage-alert
- enrich-ioc
- document-in-case
- close-case-artifact
required_roles:
chronicle: roles/chronicle.viewer
soar: roles/chronicle.editor
gti: GTI Standard
personas: [tier1-analyst]
generated:
by: human:dandye
at: 2026-02-04T06:27:43-05:00
---
# Full Alert Triage Workflow
A composite skill that orchestrates the complete Tier 1 alert triage process from initial receipt to disposition (close or escalate).
## Inputs
- `CASE_ID` or `ALERT_ID` - The alert/case to triage (required)
## Orchestrated Workflow
```
┌─────────────────────────────────────────────────────────────────┐
│ FULL ALERT TRIAGE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ START │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /check-duplicates │ │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────┐ │
│ ▼ ▼ │
│ DUPLICATE NOT DUPLICATE │
│ │ │ │
│ ▼ ▼ │
│ Close & ┌─────────────────────┐ │
│ Document │ /triage-alert │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────┴─────────┐ │
│ │ │ For each entity: │ │
│ │ │ /enrich-ioc │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────┴─────────┐ │
│ │ │ DECISION │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────────┼────────────────┐ │
│ │ ▼ ▼ ▼ │
│ │ FP/BTP TP/Suspicious Inconclusive │
│ │ │ │ │ │
│ │ ▼ ▼ ▼ │
│ │ /document-in-case /document-in-case /document-in-case │
│ │ /close-case-artifact ESCALATE Request more info │
│ │ │ │ │ │
│ └─────┴──────────────────┴──────────────────┘ │
│ │ │
│ ▼ │
│ /generate-report │
│ │ │
│ ▼ │
│ END │
│ │
└─────────────────────────────────────────────────────────────────┘
```
## Detailed Steps
### Phase 1: Pre-Check
**Step 1.1: Check for Duplicates**
Invoke: `/check-duplicates CASE_ID=$CASE_ID`
- If duplicate confirmed:
- Invoke: `/document-in-case` with "Closing as duplicate of [Similar Case ID]"
- Invoke: `/close-case-artifact` with reason NOT_MALICIOUS
- **END WORKFLOW**
- If not duplicate: Continue to Phase 2
### Phase 2: Initial Triage
**Step 2.1: Perform Alert Triage**
Invoke: `/triage-alert CASE_ID=$CASE_ID`
Extract from results:
- `CLASSIFICATION` - FP, BTP, TP, or Suspicious
- `KEY_ENTITIES` - List of IOCs (IPs, domains, hashes, URLs)
- `ALERT_TYPE` - Type of alert (malware, authentication, network, etc.)
- `PRIORITY` - Suggested priority level
### Phase 3: Enrichment
**Step 3.1: Enrich Each Entity**
For each entity in `KEY_ENTITIES`:
Invoke: `/enrich-ioc IOC_VALUE=$entity`
Collect:
- `GTI_FINDINGS` - Threat intelligence results
- `SIEM_CONTEXT` - SIEM entity summary
- `IOC_MATCH_STATUS` - Whether IOC appears in threat feeds
Update `CLASSIFICATION` if enrichment reveals new information.
### Phase 4: Decision & Action
**Step 4.1: Make Final Classification**
Based on triage and enrichment, confirm classification:
| Classification | Criteria | Action |
|---------------|----------|--------|
| **False Positive (FP)** | No malicious indicators, known benign | Close |
| **Benign True Positive (BTP)** | Real but authorized/expected | Close |
| **True Positive (TP)** | Confirmed malicious | Escalate |
| **Suspicious** | Inconclusive, warrants investigation | Escalate |
**Step 4.2: Execute Disposition**
**If FP or BTP:**
1. Invoke: `/document-in-case` with:
- Classification and rationale
- Evidence summary from enrichment
- Closure justification
2. Invoke: `/close-case-artifact` with:
- Reason: NOT_MALICIOUS
- Root cause: Appropriate option (e.g., "Legit action", "Normal behavior")
**If TP or Suspicious:**
1. Invoke: `/document-in-case` with:
- Classification and rationale
- Evidence summary
- Recommended next steps
2. Output escalation recommendation:
- Escalate to Tier 2
- Suggest appropriate follow-up skill based on alert type:
- Malware → `/triage-malware`
- Authentication → `/triage-suspicious-login`
- IOC-focused → `/deep-dive-ioc`
### Phase 5: Report
**Step 5.1: Generate Triage Report**
Invoke: `/generate-report REPORT_TYPE=triage`
Include:
- Case/Alert ID
- Classification with rationale
- Key entities and enrichment results
- SIEM queries executed
- Disposition taken
- Next steps (if escalated)
## Outputs
| Output | Description |
|--------|-------------|
| `FINAL_CLASSIFICATION` | FP, BTP, TP, or Suspicious |
| `DISPOSITION` | Closed or Escalated |
| `EVIDENCE_SUMMARY` | Key findings from triage and enrichment |
| `REPORT_PATH` | Path to generated triage report |
| `ESCALATION_TARGET` | If escalated, recommended next skill/tier |
## Error Handling
- If `/check-duplicates` fails → Log warning, continue with triage
- If `/enrich-ioc` fails for an entity → Log warning, continue with other entities
- If `/close-case-artifact` fails → Log error, manual closure required
- If any MCP tool unavailable → Document limitation, proceed with available data
## Performance Targets
- Total workflow time: < 15 minutes
- Duplicate detection: < 1 minute
- Per-entity enrichment: < 2 minutes
- Target accuracy: > 90% correct classification
---
name: full-alert-triage
description: "Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing."
type: workflow
orchestrates:
- check-duplicates
- triage-alert
- enrich-ioc
- document-in-case
- close-case-artifact
required_roles:
chronicle: roles/chronicle.viewer
soar: roles/chronicle.editor
gti: GTI Standard
personas: [tier1-analyst]
generated:
by: human:dandye
at: 2026-02-04T06:27:43-05:00
---
# Full Alert Triage Workflow
A composite skill that orchestrates the complete Tier 1 alert triage process from initial receipt to disposition (close or escalate).
## Inputs
- `CASE_ID` or `ALERT_ID` - The alert/case to triage (required)
## Orchestrated Workflow
```
┌─────────────────────────────────────────────────────────────────┐
│ FULL ALERT TRIAGE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ START │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /check-duplicates │ │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────┐ │
│ ▼ ▼ │
│ DUPLICATE NOT DUPLICATE │
│ │ │ │
│ ▼ ▼ │
│ Close & ┌─────────────────────┐ │
│ Document │ /triage-alert │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────┴─────────┐ │
│ │ │ For each entity: │ │
│ │ │ /enrich-ioc │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────┴─────────┐ │
│ │ │ DECISION │ │
│ │ └───────────┬─────────┘ │
│ │ │ │
│ │ ┌───────────────┼────────────────┐ │
│ │ ▼ ▼ ▼ │
│ │ FP/BTP TP/Suspicious Inconclusive │
│ │ │ │ │ │
│ │ ▼ ▼ ▼ │
│ │ /document-in-case /document-in-case /document-in-case │
│ │ /close-case-artifact ESCALATE Request more info │
│ │ │ │ │ │
│ └─────┴──────────────────┴──────────────────┘ │
│ │ │
│ ▼ │
│ /generate-report │
│ │ │
│ ▼ │
│ END │
│ │
└─────────────────────────────────────────────────────────────────┘
```
## Detailed Steps
### Phase 1: Pre-Check
**Step 1.1: Check for Duplicates**
Invoke: `/check-duplicates CASE_ID=$CASE_ID`
- If duplicate confirmed:
- Invoke: `/document-in-case` with "Closing as duplicate of [Similar Case ID]"
- Invoke: `/close-case-artifact` with reason NOT_MALICIOUS
- **END WORKFLOW**
- If not duplicate: Continue to Phase 2
### Phase 2: Initial Triage
**Step 2.1: Perform Alert Triage**
Invoke: `/triage-alert CASE_ID=$CASE_ID`
Extract from results:
- `CLASSIFICATION` - FP, BTP, TP, or Suspicious
- `KEY_ENTITIES` - List of IOCs (IPs, domains, hashes, URLs)
- `ALERT_TYPE` - Type of alert (malware, authentication, network, etc.)
- `PRIORITY` - Suggested priority level
### Phase 3: Enrichment
**Step 3.1: Enrich Each Entity**
For each entity in `KEY_ENTITIES`:
Invoke: `/enrich-ioc IOC_VALUE=$entity`
Collect:
- `GTI_FINDINGS` - Threat intelligence results
- `SIEM_CONTEXT` - SIEM entity summary
- `IOC_MATCH_STATUS` - Whether IOC appears in threat feeds
Update `CLASSIFICATION` if enrichment reveals new information.
### Phase 4: Decision & Action
**Step 4.1: Make Final Classification**
Based on triage and enrichment, confirm classification:
| Classification | Criteria | Action |
|---------------|----------|--------|
| **False Positive (FP)** | No malicious indicators, known benign | Close |
| **Benign True Positive (BTP)** | Real but authorized/expected | Close |
| **True Positive (TP)** | Confirmed malicious | Escalate |
| **Suspicious** | Inconclusive, warrants investigation | Escalate |
**Step 4.2: Execute Disposition**
**If FP or BTP:**
1. Invoke: `/document-in-case` with:
- Classification and rationale
- Evidence summary from enrichment
- Closure justification
2. Invoke: `/close-case-artifact` with:
- Reason: NOT_MALICIOUS
- Root cause: Appropriate option (e.g., "Legit action", "Normal behavior")
**If TP or Suspicious:**
1. Invoke: `/document-in-case` with:
- Classification and rationale
- Evidence summary
- Recommended next steps
2. Output escalation recommendation:
- Escalate to Tier 2
- Suggest appropriate follow-up skill based on alert type:
- Malware → `/triage-malware`
- Authentication → `/triage-suspicious-login`
- IOC-focused → `/deep-dive-ioc`
### Phase 5: Report
**Step 5.1: Generate Triage Report**
Invoke: `/generate-report REPORT_TYPE=triage`
Include:
- Case/Alert ID
- Classification with rationale
- Key entities and enrichment results
- SIEM queries executed
- Disposition taken
- Next steps (if escalated)
## Outputs
| Output | Description |
|--------|-------------|
| `FINAL_CLASSIFICATION` | FP, BTP, TP, or Suspicious |
| `DISPOSITION` | Closed or Escalated |
| `EVIDENCE_SUMMARY` | Key findings from triage and enrichment |
| `REPORT_PATH` | Path to generated triage report |
| `ESCALATION_TARGET` | If escalated, recommended next skill/tier |
## Error Handling
- If `/check-duplicates` fails → Log warning, continue with triage
- If `/enrich-ioc` fails for an entity → Log warning, continue with other entities
- If `/close-case-artifact` fails → Log error, manual closure required
- If any MCP tool unavailable → Document limitation, proceed with available data
## Performance Targets
- Total workflow time: < 15 minutes
- Duplicate detection: < 1 minute
- Per-entity enrichment: < 2 minutes
- Target accuracy: > 90% correct classification
Imported from the listed AgentSkill.sh category. Complete supplied package files and notices are retained. Required external tools and credentials are not installed. No bundled code was executed during import. Individual agent task behavior has not been tested.