/triage
Triage a SOC alert end-to-end — validate, enrich, decide, and escalate or close with rationale.
$ npx -y skills add jassics/awesome-claude-security --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/triage
Context preview
What this command does when you run it.
Triage a SOC alert end-to-end — validate, enrich, decide, and escalate or close with rationale.
Command definition
triage.mddescription: Triage a SOC alert end-to-end — validate, enrich, decide, and escalate or close with rationale. argument-hint: [alert / detection name + context]
Triage this alert: **$ARGUMENTS**
Walk the triage, using installed skills (note any whose plugin is missing):
1. **Triage** — `/soc-siem:alert-triage` to validate the alert, gather the surrounding telemetry, and judge true vs. false positive. 2. **Enrich** — `/threat-intelligence:ioc-enrichment` on any indicators (IPs, domains, hashes) to add reputation and context. 3. **Map** — `/security-knowledge:attack-lookup` to tag the behavior with its ATT&CK technique. 4. **Decide** — close (with reason) if benign; otherwise escalate. State the tier, severity, and what the next responder needs. 5. **Hand off / report** — escalate to `/security-analyst:investigate` for deeper analysis, or capture a short `/security-reporting:finding` if actionable. Note detection-tuning feedback for `detection-engineering`.
For deep execution, hand off to the `soc-analyst` agent. Every verdict needs evidence and a one-line rationale — no "looks suspicious, escalating" without specifics.
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Repo: jassics/awesome-claude-security
Other commands on awesome-claude-security.
- /safety-review
Run an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
Open command - /defend
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
Open command - /board-brief
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
Open command - /tech-review
Assess technology/security risk for a strategic decision and frame the secure-by-design path.
Open command - /precommit
Run the pre-commit security gate on the current changeset and report a single pass/fail verdict.
Open command - /assessment
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
Open command