Incidents - SoCMate

SoCMate automatically syncs incidents from Microsoft Sentinel, enriches them with local metadata, and lets you launch AI-powered investigations directly from any incident.

Incident Sync

SoCMate syncs incidents from Sentinel every 5 minutes (configurable). The sync process:

Queries Sentinel for incidents within a configurable time window (default: last 24 hours)
Compares incoming incidents against existing records
Upserts incidents, preserving any local enrichment fields (notes, tags, assignments)
Sends notifications for new Medium, High, and Critical severity incidents

The sync is incremental. SoCMate tracks which incidents it has already seen and only processes new or updated ones. Local enrichment fields like notes, tags, and assignments are never overwritten by the sync.

Listing Incidents

From the UI

Navigate to Incidents in the sidebar. The incident list shows severity, status, title, and timestamps. Use the filters to narrow by severity or status.

From the API

curl -X GET "https://api.socmate.yourcompany.com/api/v1/incidents?severity=high&status=new&limit=20" \
  -H "Authorization: Bearer <token>"

Query parameters:

Parameter	Type	Default	Description
`severity`	string	—	Filter: `informational`, `low`, `medium`, `high`, `critical`
`status`	string	—	Filter: `new`, `active`, `closed`
`timespan`	string	`P7D`	ISO 8601 duration for time range
`limit`	integer	`20`	Maximum results
`offset`	integer	`0`	Pagination offset

Incident data is cached with a 5-minute TTL. The first request after cache expiration may be slightly slower as it refreshes from Sentinel.

Incident Details

Get a single incident by its Sentinel incident number:

curl -X GET https://api.socmate.yourcompany.com/api/v1/incidents/12345 \
  -H "Authorization: Bearer <token>"

The response includes the full incident payload from Sentinel plus any local enrichment fields.

Severity Levels

SoCMate maps Sentinel severity levels directly:

Severity	Description	Notification
Informational	Low-impact events for awareness	No automatic notification
Low	Minor events unlikely to affect operations	No automatic notification
Medium	Events that may require investigation	Notification sent
High	Events likely impacting security posture	Notification sent
Critical	Events requiring immediate attention	Notification sent

Local Enrichment

Enrich incidents with local metadata that is preserved across syncs:

curl -X PATCH https://api.socmate.yourcompany.com/api/v1/incidents/12345 \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "notes": "Appears related to incident #12340 — same source IP",
    "local_status": "in_progress",
    "assigned_to": "analyst@example.com",
    "tags": ["phishing", "priority", "escalated"]
  }'

Enrichment fields:

Field	Type	Description
`notes`	string	Free-text notes about the incident
`local_status`	string	Local tracking status (independent of Sentinel status)
`assigned_to`	string	Email of the assigned analyst
`tags`	list[string]	Custom tags for categorization

Deterministic Enrichment

Trigger an automated enrichment that resolves the full incident chain:

curl -X POST https://api.socmate.yourcompany.com/api/v1/incidents/12345/enrich \
  -H "Authorization: Bearer <token>"

This runs queries to resolve:

Incident details from Sentinel
Alerts associated with the incident
Entities extracted from the alerts (IPs, users, hosts, file hashes)

The enrichment results are stored with the incident and available for subsequent investigation.

Investigating an Incident

Launch an AI-powered investigation directly from an incident. From the UI, click the Investigate button on any incident. From the API, start an investigation referencing the incident context:

curl -X POST https://api.socmate.yourcompany.com/api/v1/investigations/start \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Investigate Sentinel incident #12345 — multiple failed sign-in attempts from unusual locations",
    "persona": "soc_analyst",
    "provider": "sentinel"
  }'

The investigation uses the incident title, description, severity, and any enrichment data as context.

Notifications

SoCMate sends notifications when new Medium, High, or Critical incidents are synced from Sentinel. Notifications include:

Incident title and number
Severity level
Current Sentinel status
Direct link to the incident in SoCMate

Configure notification preferences in your user settings under Settings > Notifications.

​Incident Sync

​Listing Incidents

​From the UI

​From the API

​Incident Details

​Severity Levels

​Local Enrichment

​Deterministic Enrichment

​Investigating an Incident

​Notifications

Incident Sync

Listing Incidents

From the UI

From the API

Incident Details

Severity Levels

Local Enrichment

Deterministic Enrichment

Investigating an Incident

Notifications