Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andycungkrinx91/konoha --skill building-soc-escalation-matrixgit clone --depth 1 https://github.com/andycungkrinx91/konohaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andycungkrinx91/konoha/building-soc-escalation-matrix)<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/building-soc-escalation-matrix"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/building-soc-escalation-matrix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/building-soc-escalation-matrix"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/building-soc-escalation-matrix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01667 |
| Opus 5.5 | $0.00013 | $0.00667 |
| Sonnet 5.5 | $0.00007 | $0.00333 |
| Haiku 4.5 | $0.00003 | $0.00167 |
Grade A, and why
building-soc-escalation-matrix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to building-soc-escalation-matrix — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Building SOC Escalation Matrix
Overview
A SOC escalation matrix defines how security incidents move through the organization based on severity, impact, and response requirements. Modern SOCs use context-driven escalation combining business risk, asset criticality, and data sensitivity rather than purely severity-based models. Organizations using AI and automation in their SOC cut detection-and-containment lifecycle to approximately 161 days, an 80-day improvement over the 241-day industry average.
When to Use
- When deploying or configuring building soc escalation matrix capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with soc operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
SOC Tier Structure
Tier 1 - Alert Triage Analyst
- Monitors SIEM dashboards and alert queues
- Performs initial alert classification (true/false positive)
- Handles P3 and P4 incidents to resolution
- Escalates P1 and P2 incidents to Tier 2 within SLA
- Documents initial findings in ticketing system
Tier 2 - Incident Analyst
- Performs deep-dive investigation on escalated incidents
- Conducts root cause analysis and scoping
- Executes containment procedures
- Handles P2 incidents to resolution
- Escalates P1 incidents to Tier 3 or management
Tier 3 - Senior Analyst / Threat Hunter
- Handles P1 critical incidents and APT investigations
- Performs proactive threat hunting
- Develops detection rules and playbooks
- Conducts malware reverse engineering
- Leads incident response for major breaches
Management Escalation
- SOC Manager: Operational decisions, resource allocation
- CISO: Business impact decisions, executive communication
- Legal/PR: Data breach notification, media response
- External IR: Third-party incident response engagement
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 221 lines · 33 tokens per session scan A 6a2412892d1a
building-soc-escalation-matrix is a skill published in the GitHub repository andycungkrinx91/konoha (12 stars, last pushed today), licensed MIT. It adds 33 tokens to every session and 1,667 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to building-soc-escalation-matrix, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
building-soc-escalation-matrix
Build a structured SOC escalation matrix defining severity tiers, response SLAs, escalation paths, and notification procedures for security incidents.
building-soc-escalation-matrix
Build a structured SOC escalation matrix defining severity tiers, response SLAs, escalation paths, and notification procedures for security incidents.
building-soc-escalation-matrix
Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notification procedures for security incidents, using context-driven criteria that combine business risk, asset criticality, and data sensitivity. Use when designing or revising how a SOC triages and escalates…
building-soc-escalation-matrix
Build a structured SOC escalation matrix defining severity tiers, response SLAs, escalation paths, and notification procedures for security incidents.
mk:decision-framework
Operational decision frameworks: triage, escalation, case management, billing ops. Use for 'how to handle X cases', 'build triage', 'escalation protocol'.
issue-triage
Triage Paperclip inbox issues that are stale, blocked, in-review, or assigned-but-not-progressing, and decide a single next action per issue (resume, reassign, unblock, escalate, or close).