Alert Inbox
Checking…

Endpoint

POST …

Send Authorization: Bearer <SOCBUDDY_INGEST_SECRET> and a JSON body. The endpoint runs full SOC triage and returns a structured report.

curl -X POST '…' \
  -H 'Authorization: Bearer <SOCBUDDY_INGEST_SECRET>' \
  -H 'Content-Type: application/json' \
  -d '{ "source": "Suricata", "alertId": "evt-2026-0420-001", "timestamp": "2026-06-20T14:11:03Z", "severity": "high", "title": "ET MALWARE Cobalt Strike Beacon (http)", "host": "fin-wks-21.corp.local", "user": "j.doe", "src_ip": "10.0.4.22", "dst_ip": "185.193.88.42", "indicators": ["185.193.88.42", "/jquery-3.3.1.min.js"], "raw": { "rule": "ET MALWARE Cobalt Strike Beacon", "proto": "TCP", "dest_port": 443, "http_user_agent": "Mozilla/5.0 (compatible; MSIE 9.0)" } }'
Guided walkthrough · 1/3

Three quick taps to see SOCbuddy triage a SIEM alert end-to-end.

  1. Paste the sample JSON
    Loads a Suricata Cobalt Strike beacon event into the editor.
  2. 2
    Tap "Triage now"
    Runs the same AI pipeline as the public ingest endpoint.
  3. 3
    View the structured report
    Severity, MITRE TTPs, indicators and recommended actions.

Paste an alertUses the same triage pipeline as the public endpoint