annatchijova·annatchijova/SKILLS/alert-triage-economics/SKILL.md

alert-triage-economics

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Triage a security alert queue by expected loss, not by the severity label the tool stamped — because analyst attention is a scarce, exhaustible resource and a SOC's real failure is not a missed rule but a queue that trains its analysts to dismiss. Use whenever there is a backlog of alerts to prioritize, a "we get 10,000 alerts a day" problem, a decision about which detections to keep, or a claim that a queue is "under control": "which alerts do we work first", "we're drowning in alerts", "alert fatigue", "too many false positives", "should we even keep this rule", "the SOC missed it but the alert did fire", "tune the queue". Sibling of detection-engineering (which builds the rule that fires) and dual-use-behavior-adjudication (which decides what one firing means); this skill governs how a finite team spends attention across many firings. It does not write detection logic or adjudicate a single alert in isolation, and never treats a tool's severity field as a priority.