Sec-Link/Argus-Agentic-SOC-Platform

cloud-iam-anomaly-triage

Analyze suspicious cloud identity and access events, including role changes, new keys, unusual regions, and privilege escalation. Recommend evidence-preserving response actions.

Idioma del texto original: inglés

data-exfiltration-detection

Assess possible data movement using destinations, protocols, volume, files, and user context. Identify evidence gaps and recommend low-risk validation and containment actions.

Idioma del texto original: inglés

dns-command-and-control-investigation

Analyze suspicious DNS behavior such as high entropy, beaconing, rare domains, unusual record types, and query volume. Distinguish indicators from confirmed C2 and recommend safe validation.

Idioma del texto original: inglés

incident-containment-planning

Create a prioritized, reversible containment plan based only on observed evidence. Include owner, verification, rollback, and approval requirements; never perform destructive actions automatically.

Idioma del texto original: inglés

insider-threat-assessment

Assess possible insider risk from unusual access, downloads, privilege use, and policy violations. Maintain neutral language, minimize personal data, and recommend auditable investigative steps.

Idioma del texto original: inglés

malware-execution-analysis

Analyze process execution, downloaded files, hashes, parent-child chains, persistence, and host impact. Separate observed facts from hypotheses and propose safe collection and containment steps.

Idioma del texto original: inglés

phishing-email-triage

Analyze suspicious email indicators, sender authentication, URLs, attachments, user impact, and recommended containment. Never claim a link or attachment is malicious without evidence. Return concise findings and follow-up tasks.

Idioma del texto original: inglés

ransomware-response

Triage ransomware indicators such as mass file changes, encryption processes, ransom notes, and lateral movement. Prioritize isolation, evidence preservation, recovery coordination, and safe next tasks.

Idioma del texto original: inglés

suspicious-login-investigation

Investigate unusual authentication activity using source IP, account, time, geolocation, MFA, and privilege context. Recommend validation steps and avoid changing ticket status.

Idioma del texto original: inglés

vulnerability-prioritization

Prioritize vulnerabilities using asset criticality, exploitability, exposure, known exploitation, compensating controls, and business impact. Do not invent CVEs or affected versions.

Idioma del texto original: inglés