SOC Escalation Matrix Builder
Designs SOC incident severity tiers, response SLAs, and escalation paths for security teams.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
This skill teaches an AI agent how a Security Operations Center (SOC) should sort security incidents into priority levels (P1 to P4), decide who handles each one, and set response and update deadlines. Once installed, the agent can draft a complete escalation matrix with tiers, notification steps and message templates, and it can apply context such as asset criticality and data sensitivity rather than severity alone. It also includes two Python scripts that build and simulate these matrices.
Great for
- SOC managers or security leads designing or revising incident triage and escalation rules
- Security engineers configuring SOAR playbooks with escalation timers
- Students or trainers learning how tiered SOC operations work
Skip it if
- Live incident response, because the skill produces planning documents and generic logic, not real-time response decisions (the SLAs and thresholds are example values that must be validated against your organisation's policies and regulatory obligations)
- Organisations that copy the default SLAs and triggers without review, since the file presents them as a single template that may not fit their risk profile or legal duties
Try asking
- “Design a four-tier SOC escalation matrix for a mid-sized company that combines asset criticality with severity”
- “Draft P1 to P4 response and resolution SLAs and a communication cadence for our analyst team”
- “Create an escalation policy with time-based triggers that escalate unresolved P2 incidents to Tier 3”
- “Write an XSOAR-style playbook that auto-escalates critical incidents on high-criticality assets”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
building-soc-escalation-matrix.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-soc-escalation-matrix.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-soc-escalation-matrix.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Replace the example SLA numbers and escalation contacts with values from your own SOC policy and any regulatory notification deadlines before relying on the output.
- Review scripts/agent.py and scripts/process.py before running them, since they execute Python and contain hard-coded notification channels such as Slack, PagerDuty and SMS that you will need to change.
- Give the agent your asset inventory categories and business context so it can tailor the escalation decision matrix instead of using the generic one.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.