Suspicious Login Triage Skill

Guide initial triage of suspicious login alerts (impossible travel, untrusted location, multiple failed logins) for Tier 1 SOC Analysts.

Inputs

• CASE_ID - SOAR case ID containing the alert(s)
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from the case
• (Optional) USER_ID - The user ID if known upfront
• (Optional) SOURCE_IP - The source IP if known upfront

Workflow

Step 1: Get Case Context

secops-soar.get_case_full_details(case_id=CASE_ID)