Before
SOC analysts had to inspect incoming alerts, search recent Jira incidents using multiple queries, compare indicators and affected entities, and decide whether an alert was new, duplicated, or related. They also had to write incident records, prepare remediation tasks, assign work, and group related stories into Epics manually.
How it works
- Receive the incident and search recent records for duplicate or related stories using extracted entities, indicators, source details, and threat objects.
- Apply automated correlation and triage, with optional enrichment when the available alert data does not support a confident investigation decision.
- Create or update the appropriate Jira Story, remediation tasks, and parent Epic, or return a duplicate result when an existing incident already covers the alert.
Workflow details
- Incident intake and duplicate detection: The workflow receives raw incident context from an upstream event handler, extracts identifiers such as affected entities, source systems, users, IP addresses, and threat objects, and searches recent Jira incidents using multiple correlation queries.
- Correlation decision: An AI analyst compares the incoming incident with matching Jira stories using timestamps, affected entities, sources, and indicators of compromise. If a duplicate or related incident is found, the workflow returns the correlation result and can associate the story with an existing Epic rather than treating it as an isolated case.
- Triage and enrichment: For incidents requiring investigation, a triage agent evaluates the alert, identifies the likely threat object, assesses whether enrichment is necessary, and determines a preliminary verdict and confidence level. When additional investigation is needed, specialized security agents can enrich the alert using available endpoint and threat-intelligence capabilities.
- Structured incident creation: The workflow converts the assessment, severity, investigation evidence, indicators, and recommended actions into a structured Jira Story with a consistent incident format and searchable identifiers. It also determines remediation paths and creates the required remediation tasks in bulk, assigning them to an available team member.
- Incident grouping and handoff: When correlated stories share a broader threat pattern, the workflow creates or updates a parent Epic, attaches related stories to it, records shared indicators, and returns the resulting ticket reference. Analysts therefore receive a deduplicated, correlated case with investigation context and follow-up work already organized.
What changed
Duplicate and correlation checks now occur before a new incident record is created, while triage, enrichment routing, ticket formatting, task creation, assignment, and Epic grouping follow a consistent automated path. Analysts receive a structured case and organized follow-up work instead of starting with raw alert data and manual ticket assembly.
Work removed
Repeatedly searching Jira for duplicate incidents, comparing alert attributes across tickets, deciding whether enrichment is needed, writing incident summaries and descriptions, copying indicators and recommendations, creating remediation tasks individually, assigning work, and manually grouping related stories into an Epic.
Expected outcome
An estimated 10–20 recurring manual actions are removed per incident, with more consistent incident records and earlier availability of correlated remediation work.
