// tool reference · Monitoring & Detection
AI SOC Copilot Free
Ask a Claude-powered SOC analyst for triage, MITRE mapping and detections.
What it does
Ask SOC questions in plain language and get an analyst-grade answer: what a technique means, how to detect it, what to check first.
When to use it
- You hit an unfamiliar technique ID, alert name or acronym mid-triage.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| question | textarea | required | A security question in plain language. |
What you get back
A direct answer with detection guidance and next steps.
Worked example
Input
What does T1078 mean and how do I detect it?
Output (abridged)
T1078 Valid Accounts — an adversary using legitimate credentials rather than malware, which is why it evades most signature detection. Detect by anomaly, not signature: · logins outside an account's normal hours or geography · impossible travel between sessions · service accounts performing interactive logins · a first-ever login from a new ASN for a privileged user Start with: authentication success AFTER a burst of failures.
How it works
AI, grounded in a defensive system prompt. Advisory only — it never executes anything.
Privacy
Your question is sent to the AI provider. Do not paste secrets or customer data.
Standards
MITRE ATT&CK