Alert triage and enrichment
Every alert reaches the analyst already enriched, deduplicated and scored, so the first minutes of an investigation are no longer spent copying indicators between tabs.
The problem
An analyst opens an alert and starts the same routine: look up the IP, check the hash, find the user, see who owns the asset, search for similar alerts. The routine takes minutes per alert, gets skipped when the queue is long, and differs from one analyst to the next.
Stack
- SIEM
- SplunkIBM QRadar
- SOAR and cases
- Cortex XSOARCortex XSIAMSplunk SOARTheHiveServiceNowJira
- Threat intelligence
- Recorded FutureVirusTotalAbuseIPDBurlscanShodanMISP
How it works
- 1
Ingest
The SIEM (Splunk or QRadar) or the XDR sends the alert to the SOAR or case manager through a webhook, an API poll or a notable-event export.
- 2
Normalize
Fields are mapped to one schema, so a playbook behaves the same whichever detection rule raised the alert.
- 3
Deduplicate and group
Alerts that share an entity, a rule and a time window collapse into one case with a counter, instead of forty tickets.
- 4
Enrich
Indicators go through Recorded Future, VirusTotal, AbuseIPDB, urlscan and Shodan. Users and assets are resolved against the directory and the CMDB.
- 5
Score and route
A risk score combines indicator reputation, asset criticality and user role. Known low-risk patterns close with a recorded reason. The rest go to the right queue with the enrichment attached.
- 6
Record
Everything lands in the case in ServiceNow, Jira or TheHive, so the investigation starts from evidence instead of a blank page.
Guardrails and failure handling
- Auto-close rules are explicit, versioned and limited to patterns reviewed with the SOC. Every automatic closure keeps its reason and the data it used.
- Each enrichment source has a timeout, a retry policy and a fallback, so one API outage degrades the case instead of blocking the queue.
- API quotas are tracked and results are cached, so the same indicator is never paid for twice.
What changes for the SOC
- Analysts start from a case that already holds reputation, asset and user context.
- Duplicate alerts stop multiplying tickets.
- Triage follows the same steps on every shift.
- Closure reasons are recorded, which exposes noisy rules and makes them easy to tune.