A structured cybersecurity alert triage application that transforms raw alert data into step-by-step investigative guidance aligned with real SOC workflows.
- 9-Phase Triage Framework: Executive Summary, Hypotheses, Investigation Checklist, Artefact Analysis, MITRE ATT&CK Mapping, Severity & Priority, Verdict, SOC Documentation, References
- MITRE ATT&CK Mapping: Automatic mapping of alert indicators to ATT&CK Tactics, Techniques, and Sub-Techniques
- Multi-Source Support: EDR, SIEM, XDR, email security, identity, firewall, proxy, cloud, and threat intel sources
- Structured Output: Professional MDR-quality triage notes ready for SOC documentation
- Verdict Assessment: True Positive, False Positive, Benign Positive, Inconclusive classifications
pip install -e .# Interactive mode
alert-triage
# From JSON file
alert-triage --input alert.json
# From JSON string
alert-triage --json '{"alert_source": "CrowdStrike", "alert_name": "Suspicious PowerShell"}'from src.engine.triage_engine import TriageEngine
engine = TriageEngine()
alert_data = {
"alert_source": "CrowdStrike Falcon",
"alert_name": "Suspicious PowerShell Execution",
"timestamp": "2026-03-07T14:32:00Z",
"host_user": "WORKSTATION-42 / jdoe",
"severity": "High",
"alert_description": "PowerShell process launched with encoded command",
"observed_indicators": {
"process_names": ["powershell.exe"],
"command_lines": ["powershell.exe -enc SQBFAFgA..."]
}
}
report = engine.triage(alert_data)
print(report.render())src/
engine/ # Core triage engine (9-phase framework)
models/ # Data models for alerts, verdicts, reports
formatters/ # Output formatters (text, JSON, markdown)
mappers/ # MITRE ATT&CK mapping logic
utils/ # Utilities (validation, parsing)
tests/ # Unit tests
examples/ # Example alert inputs
MIT