<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-security-tool-evaluation
description: >-
  Evaluate EDR/SIEM/SOAR tools with structured criteria
domain: cybersecurity
subdomain: soc-operations
tags:
  - soc-operations
  - security-automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Performing Security Tool Evaluation

## Overview
Evaluate EDR/SIEM/SOAR tools with structured criteria. Provides structured workflows and tool integrations.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ | Required |
| Relevant domain tools installed | Required |

## Key Concepts
### Core Workflow
1. **Scope** — Define assessment boundaries
2. **Analyze** — Execute domain-specific checks
3. **Validate** — Cross-reference findings
4. **Report** — Generate structured JSON output

## Workflow
### Step 1: Run Analysis
```bash
node scripts/agent.js analyze --target <scope>
```
### Step 2: Generate Report
```bash
node scripts/agent.js report --target <scope>
```

## Verification
- [ ] All scope items assessed
- [ ] Findings validated
- [ ] JSON report generated

## References
- NIST CSF 2.0
- CIS Controls v8
- MITRE ATT&CK
