community-automations/siem-alert-enrichment

DevOps & Code

PublicClaude subagent

SIEM Alert Enrichment

Security teams drown in SIEM alerts, most of which are noise that still takes minutes each to investigate by hand. This automation does the first-pass research before a human ever looks.

sonnet1 weekSplunkVirusTotalAbuseIPDBMISP
ClaudeClaude
ROI for
README.md

Why this subagent

Security teams drown in SIEM alerts, most of which are noise that still takes minutes each to investigate by hand. This automation does the first-pass research before a human ever looks.

It enriches every indicator with threat intel, asset ownership, and related events, then scores the alert. Analysts only get paged for the ones that matter, with the evidence already attached, so triage starts from context instead of a blank screen.

How it runs

    • Read

      Used at step 01 to kick off the pipeline.

    • Write

      Used at step 01 to kick off the pipeline.

    • WebFetch

      Used at step 01 to kick off the pipeline.

    • WebSearch

      Used at step 01 to kick off the pipeline.

Sample output

json
// Sample output
// (generated when the pipeline finishes)

Take a raw SIEM alert, enrich every indicator with threat-intel and asset context, then return a triage verdict (escalate or suppress) with a confidence score and the evidence behind it.

Unlock the rest

The full agent definition, install snippet, and starter task are gated for community members.

Members get the full `.md` agent file, the npm / pnpm install one-liners, a starter prompt that we've tuned against real runs, and the open-source repo when this automation ships there. One email, magic link, done.