| 1 | # Quickstart (SOC Operators) |
| 2 | |
| 3 |  |
| 4 | |
| 5 | ## Where you spend most of your time |
| 6 | |
| 7 | - **Incident Management → Alerts**: triage, investigate, and decide next actions. |
| 8 | - **Incident Management → Cases**: manage the lifecycle of incidents. |
| 9 | |
| 10 | ## Core workflows |
| 11 | |
| 12 | ### 1) Triage an alert |
| 13 | - Open alert details |
| 14 | - Review assets/context |
| 15 | - Add tags (use your tagging taxonomy) |
| 16 | - Add comments and assign if needed |
| 17 | |
| 18 | ### 2) Create and link a case |
| 19 | |
| 20 |  |
| 21 | |
| 22 | - Create a case from the alert when it needs tracking |
| 23 | - Link related alerts to the same case |
| 24 | |
| 25 | ### 3) Attach evidence (artifacts) |
| 26 | |
| 27 |  |
| 28 | |
| 29 | - Upload case artifacts (files, exports) |
| 30 | - Use report templates when generating customer-ready PDFs |
| 31 | |
| 32 | ### 4) Use SIEM search context |
| 33 | - When an alert references `index_name` + `index_id`, use the SIEM view to pivot into surrounding events |
| 34 | |
| 35 | ## If you can’t see alerts you expect |
| 36 | - Your org may have **tag-based access control** enabled (alerts require an allowed tag). |
| 37 | - See: **Developer / AI Agent Docs → Database Schema → Tag access control and alert visibility** for the underlying model. |