// tool reference · Monitoring & Detection
AI SOC Copilot Free
Ask a Claude-powered SOC analyst for triage, MITRE mapping and detections.
What it does
Ask SOC questions in plain language and get an analyst-grade answer: what a technique means, how to detect it, what to check first.
When to use it
- You hit an unfamiliar technique ID, alert name or acronym mid-triage.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| question | textarea | required | A security question in plain language. |
What you get back
A direct answer with detection guidance and next steps.
Worked example
Input
What does T1078 mean and how do I detect it?
Output (abridged)
T1078 Valid Accounts — an adversary using legitimate credentials rather than malware, which is why it evades most signature detection. Detect by anomaly, not signature: · logins outside an account's normal hours or geography · impossible travel between sessions · service accounts performing interactive logins · a first-ever login from a new ASN for a privileged user Start with: authentication success AFTER a burst of failures.
How it works
AI, grounded in a defensive system prompt. Advisory only — it never executes anything.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It answers from general security knowledge, not from your environment. It has not seen your logs, your architecture or your alerts, so treat it as a knowledgeable colleague at a whiteboard -- not as a tool that knows your estate.
Privacy
Your question is sent to the AI provider. Do not paste secrets or customer data.
Standards
MITRE ATT&CK