SOC triage: from finding to detection rule — Guide

Use the authenticated run detail to review the finding identifier, severity, ATT&CK technique, OWASP category, detection gap, and recommended defense. The detection gap describes what the defender failed to catch.
Severity helps order the queue, but it does not by itself prove impact, reach, or exploitation in production. Confirm the observed behavior and affected asset.
Cross-reference owasp_category (e.g. LLM01, LLM06) with /docs/concepts/owasp-llm-coverage to understand what the category covers and which assets it touches in your stack.

For a confirmed Critical or High finding, follow your organization's incident matrix and, for an eligible Starter+ run, attach the evidence pack to the ticket.
Use detection_gap + attack_technique to route: prompt injection findings → prompt-engineering owner; data exfiltration → guardrail owner; auth bypass → API gateway owner.
If `remediation.verified=true`, the suggested patch passed the recorded replay for that case. It still needs human review and system-level tests before production.

Download the Sigma rule from the run page or GET /v1/runs/{run_id}/sigma. Each rule is scoped to the specific attack pattern — not a broad signature.
Import to your SIEM using sigma-cli or your platform's native import. Map the log source to your LLM request log index.
Record the tests that justify moving from `starter` to `tuned` and then `verified`; elapsed time alone is not evidence.