soc-investigation-planning

Plan and resume a scoped SOC investigation across related signals, competing hypotheses, and evidence. Use when selecting or revising multi-step investigation work, ranking the next useful questions, or importing analyst observations. Delegate hunt design, KQL, telemetry correlation, and hunt qualification to the vendored Sentinel skills.