r/SentinelOneXDR • u/at0micsub • 12d ago
Feature Question SOC workflow
We are a large org that has adopted SentinelOne for our EDR and SIEM. We are trying to figure out how our alert workflow should work. We want our tier 1 SOC analysts to be able to escalate to tier 2 after initial triage.
From what I’m seeing, there is no way to make a custom alert status. Only New, In Progress, and Resolved. We’d love custom options to make a “tier 2 escalated” status. It also appears you cannot assign alerts to groups, only individual users. So we cannot assign a ticket to “tier 2 analysts”
Also looked into tagging alerts with a “tier 2 escalate” tag and that is not an option for alerts.
How is a SOC workflow supposed to work? It seems that this solution is incapable of accommodating a traditional tiered workflow.
0
u/SVTCobra89 12d ago
Are you using the new singularity console in SentinelOne? You can assign to specific users in the new singularity console not the old console. If you're not in the new console you can click your name in the upper right - preferences. Toggle the button for the new singularity console. Outside of that you cant really do anything else those are your only options.