---
id: 04-data-security-soc-alert-triage
name: soc-alert-triage
source: lara-squads-import
source_path: 04-data-security/soc-alert-triage.md
source_sha256: 530059a4f6a2da8d0dfbf077b33eb8c2ff1fe14ed34cb13ae99064d9f0037427
status: active
---

# soc-alert-triage

> Espelhado de LARA/Squads para o catálogo canônico do OpenLife. Runtime deve ler este arquivo em `.catalog/squads`, não o Obsidian.

---
tags: [lara, squad, soc-alert-triage]
versão: "1.0.0"
engine: "—"
localização: ~/squads/soc-alert-triage/
atualizado: 2026-03-17
---

# Squad: soc-alert-triage

Triagem de alertas de segurança SOC.

---


## 🤖 Agentes

| Agente | Papel |
|---|---|
| [[alert-classifier]] | Security Alert Classification Specialist |
| [[analyst-brief-generator]] | SOC Analyst Brief Generation Specialist |
| [[context-enricher]] | Threat Context Enrichment Specialist |
| [[false-positive-filter]] | False Positive Detection & Filtering Specialist |
| [[threat-prioritizer]] | Threat Prioritization & Risk Scoring Specialist |


## 📁 squad.yaml

```yaml
name: soc-alert-triage
version: 1.0.0
description: "Squad especialista em triagem de alertas SOC para cybersecurity — classificação automatizada, filtragem de falsos positivos, priorização de ameaças, enriquecimento com threat intel e geração de briefs para analistas"
author: gutomec
license: MIT
slashPrefix: sat

openlife:
  minVersion: "2.1.0"
  type: squad

components:
  agents:
    - alert-classifier.md
    - false-positive-filter.md
    - threat-prioritizer.md
    - context-enricher.md
    - analyst-brief-generator.md
  tasks:
    - classify-alerts.md
    - filter-false-positives.md
    - prioritize-threats.md
    - enrich-context.md
    - generate-analyst-brief.md
    - full-alert-triage.md
  workflows:
    - full-alert-triage-workflow.yaml
    - rapid-classification-workflow.yaml
  checklists: []
  templates: []
  tools: []
  scripts: []

config:
  extends: extend
  coding-standards: config/coding-standards.md
  tech-stack: config/tech-stack.md
  source-tree: config/source-tree.md

dependencies:
  node: []
  python: []
  squads: []

mcpTools:
  required: []
  optional: []

tags:
  - cybersecurity
  - soc
  - alert-triage
  - threat-intel
  - siem
  - incident-detection
  - false-positive

```

---
*Fonte: `~/squads/soc-alert-triage/` · 29 arquivos*
