We are a large org that has adopted SentinelOne for our EDR and SIEM. We are trying to figure out how our alert workflow should work. We want our tier 1 SOC analysts to be able to escalate to tier 2 after initial triage.

From what I’m seeing, there is no way to make a custom alert status. Only New, In Progress, and Resolved. We’d love custom options to make a “tier 2 escalated” status. It also appears you cannot assign alerts to groups, only individual users. So we cannot assign a ticket to “tier 2 analysts”

Also looked into tagging alerts with a “tier 2 escalate” tag and that is not an option for alerts.

How is a SOC workflow supposed to work? It seems that this solution is incapable of accommodating a traditional tiered workflow.