aws-samples/sample-sentinel-harness

detection-writing-sop

Standard operating procedure for writing a Sigma or YARA detection rule and self-checking it before it goes to adversarial review. Use when authoring a new detection for a technique, log source, or malware family. Covers hypothesis framing, choosing Sigma vs…

原文语言：英语

soc-triage

General true-positive / false-positive alert triage rubric for a SOC analyst. Use when any SIEM alert needs a disposition and the analyst must corroborate the signal across siem_query, asset_lookup, and enrich_ioc, assign a severity, decide…

原文语言：英语

cve-asset-triage

Standard operating procedure for correlating a single CVE to the specific assets it affects and computing the blast radius across the estate. Use when a CVE lands and the question is not just "how bad is it" but "which of MY hosts are actually affected, how…

原文语言：英语

incident-ticketing

Standard operating procedure for opening and annotating a security incident ticket at the end of a triage flow. Use when a triaged finding needs to be recorded as a ticket so a human can own containment and remediation. Covers the create_ticket field…

原文语言：英语

multi-account-ops

Standard operating procedure for triaging security/operations findings across a multi-account estate. Use when posture or ops findings arrive from several accounts and an analyst must query them with ops_query, decide which findings are noise versus which…

原文语言：英语

soc-ip-lookup

Standard operating procedure for triaging a single suspicious IP address in a SOC. Use when an IP arrives from an alert, firewall log, or threat feed and an analyst must decide whether it is malicious, whether it touched any asset in the estate, and whether…

原文语言：英语

attack-path-reasoning

Standard operating procedure for reasoning about attack paths from exposed assets using the MITRE ATT&CK framework. Use when analyzing how an adversary could move from an internet-facing or exposed asset toward crown-jewel targets, to enumerate plausible…

原文语言：英语

cve-triage-rubric

Standard operating procedure for triaging the impact of a CVE for a security operations team. Use when assessing a CVE's severity, exploitability, and asset impact, and deciding whether to patch, mitigate, monitor, or take no action. Combines CVSS, EPSS, and…

原文语言：英语

ioc-vetting

Standard operating procedure for vetting an indicator of compromise (file hash, domain, or IP address) before acting on it. Use when an IOC arrives from an alert, threat feed, or report and needs a reputation lookup, a confidence rating, and false-positive…

原文语言：英语