SOC Notification Builder

Context · Classification · Next steps

Fill in what the EDR shows and make your calls. The notification builds itself on the right. Leave a field blank and it drops out cleanly.

Import alert JSON Paste an alert payload (CrowdStrike or Microsoft Defender — auto-detected) and the fields below fill in

0 Recipient & header Client contact name Host / asset name Short description (one line, used in subject)

1 Context

Bottom line up front — what this means for the client, in plain terms

Detection type & why it matters (your definition — e.g., what a vulnerable driver is and why the detection is important)

From the alert — supplied by the EDR, reference only

What triggered the alert Point of origin (host, process, parent process, path, or network source) Who (user / identity) When (first observed) How (execution chain / delivery) Indicators of compromise (hashes, IPs, files — optional) Detection link (optional)

1b Analyst review

Your judgment — the alert can't supply these. Fill them in before sending.

Concerning indicators (leave blank if nothing stood out) Host timeline review

Appears isolated Further indicators found Not yet reviewed

Timeline detail Open questions (what EDR could not determine)

2 Classification Assessment

True Positive False Positive Benign-but-notable Under investigation

Severity

Critical High Medium Low Informational

Why it matters (or doesn't) (plain-language impact) Urgency (expected response window)

3 Next steps What we've already done What we need from you Deadline for client action (optional) Information we need from you (optional) Tracking reference Update cadence (optional)

Signoff Analyst name Team / contact

Generated notification

Copied