Correlate and enrich security alerts
Bring SIEM and endpoint alerts into one case, add threat intelligence, and estimate the affected assets. Route the evidence using your team's incident criteria.
Tools for adverse event analysis
MCP servers for the tools used in these examples.
PagerDutyAutomation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Correlate alerts across SIEM and EDR
Build me an alert correlation automation in Tracecat. When a new Microsoft Sentinel alert arrives, search CrowdStrike for activity on the same host and user within the last hour, pull related alerts from both tools into one case, and build a timeline of what happened in what order. First help me understand how this maps to DE.AE-03 and why correlation across sources beats triaging alerts one at a time. Ask me which alert types fire most in my environment. Talk me through how wide the correlation window should be.
Enrich alerts with threat intel
Build me an enrichment pipeline in Tracecat. For every new case, extract IPs, domains, and file hashes, check them against VirusTotal and GreyNoise, and write the verdicts back to the case as structured fields. Mark the case high priority when anything comes back known malicious. First help me understand how this maps to DE.AE-07 and what good threat intel integration looks like beyond hash lookups. Ask me which intel sources I have API keys for. Talk me through rate limits and caching before we wire it up.
Estimate alert impact and scope
Build me an impact assessment step for my triage in Tracecat. When a case is opened, look up the affected host and user, pull asset criticality and data sensitivity from my inventory table, count how many other systems the user can reach, and write an impact summary to the case. First help me understand how this maps to DE.AE-04 and how impact differs from severity. Ask me where asset criticality lives in my environment. Talk me through what a useful impact summary contains for an on-call analyst.
Route events to the right responders
Build me an alert routing automation in Tracecat. Classify each new case by affected system and alert type, then notify the owning team in their Slack channel with the case summary and evidence. Page on-call through PagerDuty when the case is high severity. Keep a routing table I can edit without touching the automation. First help me understand how this maps to DE.AE-06 and why routing belongs in an editable table instead of hardcoded logic. Ask me which teams own which systems. Talk me through fallback routing when no owner matches.
Declare incidents from defined criteria
Build me an incident declaration automation in Tracecat. Define my incident criteria as rules: confirmed malware on a critical asset, data leaving the network, or an account takeover. When a case meets one, escalate it to an incident, open an Incident.io incident with the case linked, and notify the security leadership channel. First help me understand how this maps to DE.AE-08 and why written incident criteria matter before automating the declaration. Ask me what my current criteria are, and help me sharpen them if they are vague. Talk me through which escalations should stay human-approved.
NIST CSF 2.0 mapping: DE.AE
Official NIST category: Adverse Event Analysis. Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- DE.AE-02AU-6CA-7IR-4SI-4
Potentially adverse events are analyzed to better understand associated activities
- Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity
- Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise
- Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation
- Use log analysis tools to generate reports on their findings
- DE.AE-03AU-6CA-7IR-4IR-5IR-8PM-16SI-4
Information is correlated from multiple sources
- Constantly transfer log data generated by other sources to a relatively small number of log servers
- Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources
- Utilize cyber threat intelligence to help correlate events among log sources
- DE.AE-04PM-9PM-11PM-18PM-28PM-30
The estimated impact and scope of adverse events are understood
- Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates
- A person creates their own estimates of impact and scope
- DE.AE-06IR-4PM-15PM-16RA-4RA-10
Information on adverse events is provided to authorized staff and tools
- Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools
- Incident responders and other authorized personnel can access log analysis findings at all times
- Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur
- Manually create and assign tickets in the organization's ticketing system when technical staff discover indicators of compromise
- DE.AE-07PM-16RA-3RA-10
Cyber threat intelligence and other contextual information are integrated into the analysis
- Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel
- Securely provide information from asset inventories to detection technologies, processes, and personnel
- Rapidly acquire and analyze vulnerability disclosures for the organization's technologies from suppliers, vendors, and third-party security advisories
- DE.AE-08IR-4IR-8
Incidents are declared when adverse events meet the defined incident criteria
- Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared
- Take known false positives into account when applying incident criteria
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.