sodejm/soc-investigation-workbench
Plan and review local evidence-backed SOC investigations; external hunt integration remains pending.
Plan and resume a scoped SOC investigation across related signals, competing hypotheses, and evidence. Use when selecting or revising multi-step investigation work, ranking the next useful questions, or importing analyst observations. Delegate hunt design, KQL, telemetry correlation, and hunt qualification to the vendored Sentinel skills.
Review a SOC investigation case for unsupported conclusions, contradictory evidence, missing telemetry, scope drift, and useful next steps. Use at investigation checkpoints or when handing an evidence-backed summary to an analyst. This reviews case reasoning and does not qualify hunts or rewrite Sentinel query flows.