CSOC Operations & Playbook Automation

$npx mdskill add Masriyan/Claude-Code-CyberSecurity-Skill/CSOC Operations & Playbook Automation

Assists CSOC teams with alert triage, playbook automation, and SOC metrics.

  • Triages SIEM alerts and automates incident response playbooks.
  • Integrates with Splunk SOAR, XSOAR, TheHive, ServiceNow, and PagerDuty.
  • Uses structured playbooks and escalation workflows to guide decisions.
  • Generates operational artifacts like playbooks, reports, and runbooks.

SKILL.md

.github/skills/CSOC Operations & Playbook AutomationView on GitHub ↗

No skill content available yet.

More from Masriyan/Claude-Code-CyberSecurity-Skill

SkillDescription
AI & LLM SecurityLLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments
Blue Team Defense & HardeningSystem hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement
Cloud Security & Container HardeningAWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment
Cryptographic Analysis & AssessmentSSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code
Exploit Development & Payload EngineeringProof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
GRC & ComplianceGovernance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation
Incident Response & Digital ForensicsIR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology
Log Analysis & SIEM IntegrationSecurity log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
Malware Analysis & SandboxingStatic and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification
Mobile Application SecurityAndroid and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments