Before
An analyst checked whether an active incident already existed for the alert, searched the ticketing system, and copied the investigation summary into the correct record. Direct creation, targeted updates, and recurring alert occurrences required separate manual handling.
How it works
- Prepare the incident summary, evidence, recommended actions, correlation key, and triage-based impact and urgency.
- Follow the requested create or update mode, or search for an active incident with the same correlation key when using upsert.
- Create the incident or append a work note to the matching record, then return the resulting ticket details.
Workflow details
- Trigger: The workflow receives a SOC incident request containing an alert, deduplication key, triage results, observables, and optional instructions to create or update a record.
- Preparation: It assembles the incident title, analysis, evidence, indicators, ATT&CK techniques, recommended actions, safeguards, correlation details, and work note from the alert and triage data.
- Priority calculation: Severity, verdict, and confidence are evaluated to derive impact and urgency, with lower priority assigned to false positives and uncertain findings.
- Routing decision: The request can directly create a new incident, directly update a specified incident, or use the default upsert path to search for an active incident with the same correlation key.
- Record handling: If a matching open incident exists, the workflow adds the new occurrence and verdict as a work note; otherwise, it creates a new incident and returns its action, number, and system identifier.
What changed
Incident routing, deduplication, priority assignment, evidence formatting, and work-note updates now happen automatically. Analysts receive a single incident outcome while retaining control over explicitly requested direct updates or record creation.
Work removed
Searching for an active incident by correlation key, deciding whether to create or update, copying alert and triage details into the record, and manually adding recurring findings as work notes.
Expected outcome
For each upserted alert, the workflow is designed to remove at least one manual ticket search and one manual work-note entry while keeping related SOC findings on the same incident.
