Alert2Action
Turns raw SIEM and EDR alerts into investigation runbooks an analyst can act on.
- Domain
- SOC automation
- Built with
- JavaScript, Node.js, MITRE ATT&CK
- Source
- github.com/notsointresting/alert2action
- npm
- npmjs.com/package/alert2action
The problem
SOC analysts drown in raw alerts that arrive without any context for the investigation.
How it works
- Converts alert JSON from Splunk, Microsoft Sentinel, CrowdStrike and Elastic.
- Maps alerts to 51 MITRE ATT&CK techniques across all 14 tactics.
- Adds recommended log queries, containment commands and false-positive checks.
Where it landed
Published on npm as alert2action. Outputs Markdown, JSON, plain text and TheHive cases.
Stack
- JavaScript
- Node.js
- MITRE ATT&CK
- CLI