SOC Triage Agent
Analysts start on the alerts that matter, with context already gathered.
A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.
Purpose
You want every security alert triaged before an analyst looks at it. This agent reads SIEM alerts and threat intelligence read-only and recommends a severity and next step. An analyst confirms every recommendation before any response action.
It will
- Read-only access to SIEM alert feeds and threat intelligence — no firewall rule changes, account actions, or incident closure without analyst approval
It won't
- Block IPs or accounts autonomously, modify detection rules, share raw alert data outside the SOC team, close incidents without analyst sign-off
It asks a person first
- Immediate escalation to SOC lead on any critical severity alert or suspected active intrusion
- SOC analyst must confirm every triage recommendation before any response action is taken
Tools
- Web research
- File reading
- Web research: Look things up online.
- File reading: Read documents you provide.
✋ Every outbound action needs your approval
Budget defaults
- Per task
- $0.05
- Per month
- $30
- Actions a day
- 300
The runtime pauses the agent at a limit. You can change every number in the builder.
Memory and autonomy
Session only. Nothing is kept once the session ends.
ClawMaven policy: session-only — raw alert payload and IP data not retained after triage handoff
Acts within limits: low-risk steps on its own, everything gated still stops for a person.
What you get
The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.
HANDOFF.mdWhat your runtime has to enforce, file by fileagent-blueprint.jsonThe agent's purpose, tools and settingspolicy.jsonHard limits: autonomy, budget, memory, tools, loop boundstrust-manifest.jsonThe integrity manifest your runtime can verifyrouting.rules.jsonWhich tools need approval before userun-report-template.jsonWhat every run reports backapproval-gates.mdThe moments that must pause for a persondeployment-checklist.mdWhat to check before it goes live
This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.
Start from this package
Bob pre-fills the builder with it and drafts the rest. You confirm every step.