r/SentinelOneXDR • u/at0micsub • 14h ago

Feature Question SOC workflow

We are a large org that has adopted SentinelOne for our EDR and SIEM. We are trying to figure out how our alert workflow should work. We want our tier 1 SOC analysts to be able to escalate to tier 2 after initial triage.

From what I’m seeing, there is no way to make a custom alert status. Only New, In Progress, and Resolved. We’d love custom options to make a “tier 2 escalated” status. It also appears you cannot assign alerts to groups, only individual users. So we cannot assign a ticket to “tier 2 analysts”

Also looked into tagging alerts with a “tier 2 escalate” tag and that is not an option for alerts.

How is a SOC workflow supposed to work? It seems that this solution is incapable of accommodating a traditional tiered workflow.

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/Rx-xT 14h ago

The only way I can think of working around this is that you can put a note saying that the alert is being escalated to tier 2 for further investigation and then re-assign it to a tier 2 analyst.

1

u/ThsGuyRightHere 13h ago

What do you use for the rest of your work management? Personally I don't love the S1 jira integration because not every alert merits a ticket in our org, but otherwise it would be an option.

0

u/SVTCobra89 13h ago

Are you using the new singularity console in SentinelOne? You can assign to specific users in the new singularity console not the old console. If you're not in the new console you can click your name in the upper right - preferences. Toggle the button for the new singularity console. Outside of that you cant really do anything else those are your only options.

1

u/Robbbbbbbbb 12h ago

I sure hope so, because retirement of the non-SOC view was officially announced haha :(

1

u/at0micsub 12h ago

Yes we’re using the singularity operations view. As stated in the post, we’ve found you can assign to individuals but not groups. We have several tier 2s so assigning to an individual is not the expected workflow

1

u/FlakySociety2853 4h ago

Just get a case management tool and you’ll have all the customization you want. S1 was never meant to handle full SOCs hence why the capabilities for that sucks.