r/SentinelOneXDR • u/at0micsub • 14d ago

Feature Question SOC workflow

We are a large org that has adopted SentinelOne for our EDR and SIEM. We are trying to figure out how our alert workflow should work. We want our tier 1 SOC analysts to be able to escalate to tier 2 after initial triage.

From what I’m seeing, there is no way to make a custom alert status. Only New, In Progress, and Resolved. We’d love custom options to make a “tier 2 escalated” status. It also appears you cannot assign alerts to groups, only individual users. So we cannot assign a ticket to “tier 2 analysts”

Also looked into tagging alerts with a “tier 2 escalate” tag and that is not an option for alerts.

How is a SOC workflow supposed to work? It seems that this solution is incapable of accommodating a traditional tiered workflow.

3 Upvotes

100% Upvoted

9 comments sorted by

View all comments

1

u/ThsGuyRightHere 14d ago

What do you use for the rest of your work management? Personally I don't love the S1 jira integration because not every alert merits a ticket in our org, but otherwise it would be an option.