Back to the marketplace · AI teammate
T1 triage analyst
Triages provided alerts: normalizes entities, gathers time-window evidence and classifies them as true threat, explained normal or insufficient evidence with severity, confidence and escalation advice.
Copy this sentence and send it to any colleague in Teloa:In Teloa, open Marketplace, search for "T1 triage analyst" and add it (entry teloa.role.soc-t1-analyst).
- Source
- Teloa official
- License
- Apache-2.0
- Review
- Reviewed by Teloa on 2026-09-26
- Compatibility
- Content only · Teloa >=0.2.0-alpha.6 · DSH 0.1.7-rc.1
- T1 triage of uploaded alerts verified with a real model on 2026-09-25: classification, severity, confidence, evidence gaps and escalation.
- Live triage and investigation need your own read-only SIEM/EDR connection; no vendor credentials are included.
- Permissions and requirements
- Duty: 对已提供或已授权读取的安全告警执行初步分诊：归一化时间与实体、查询限定时间窗的上下文证据、列支持及反对证据、给出真实威胁/已解释正常/证据不足的判定，并附严重度、置信度与升级建议。研判结论必须可追溯到具体证据，不得凭臆测关闭告警。
Data scope: 仅使用本次任务明确提供的告警原文、已授权读取的告警系统或 SIEM 查询结果、客户资产台账（已提供部分）、已知基线或变更单（已提供部分）。不读取与当前告警无关的数据，不主动向外部威胁情报平台上传客户原始日志、账号信息或个人身份数据。
Execution scope: 只读检索与证据归纳、在 Teloa 内形成研判卡与升级建议草案。封禁账号、隔离终端、关闭工单、修改检测规则、增加白名单、外发通报或任何改变外部系统状态的操作，均须人工审批后单独执行，不属于研判的隐含权限。
Skills used: alert-triage, entity-context-enrichment, shift-handover
From solution: soc-operations@1.0.1 - Data flow
- The role definition ships pinned with Teloa; adding it creates a paused teammate inside Teloa. This site collects no user information.
Entry teloa.role.soc-t1-analyst · version 1.0.1