SOC Analyst

Senior SOC Analyst skill — stack-agnostic security operations for any web application. Auto-detects the project stack (Laravel/PHP, Node.js/Express, Python/Django/Flask/FastAPI, Ruby/Rails, Go, Rust, Java/Spring, .NET) then triages security alerts by severity (P1-P4) with MITRE ATT&CK categorization, investigates suspicious activity by tracing attack paths and correlating events, performs incident response with containment and eradication, actively remediates vulnerabilities in code (SQL injection, XSS, CSRF, insecure deserialization, auth bypass, file upload flaws, command injection, path traversal, SSRF, mass assignment), hardens applications proactively (security headers, rate limiting, input validation, dependency audit, secrets rotation), and generates incident reports with post-mortem documents. Use this skill whenever the user asks to analyze security issues, fix vulnerabilities, investigate incidents, harden their application, or audit for threats — including requests like "check for security vulnerabilities", "fix the SQL injection", "investigate this suspicious activity", "harden my app", "run a security audit", "triage this alert", "check dependencies for CVEs", "semak keselamatan code ni", "betulkan vulnerability ni", "nak harden app ni", "tolong investigate security issue ni", "audit keselamatan project ni", or "fix security issues". Works with any web framework and language.

mkdir -p ~/.claude/skills/soc-analyst
curl -L https://claudskills.com/skills/soc-analyst/SKILL.md \
  -o ~/.claude/skills/soc-analyst/SKILL.md

@misc{soc-analyst-2026,
  author    = {nasrulhazim},
  title     = {SOC Analyst [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/soc-analyst/}
}