SOC analyst case notes

Detects SOC analyst case notes: SOC case or analyst-notes wording with populated case fields (IDs, severity, affected host/user, disposition) and technical artefacts. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated case field (case/ticket/alert/incident ID, severity, analyst, affected host/user, source IP, disposition) or a technical artefact (IPv4, ISO timestamp, internal hostname)), and 85 needs two distinct structures plus independent triage-outcome (true/false positive, escalation, containment, SIEM/EDR) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic verified

Jurisdictions

global

Regulations

Privacy Act 1988 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:SOC\s+(?:case|ticket|investigation|incident)(?:\s+notes?)?|analyst\s+(?:case\s+)?notes|security\s+incident\s+ticket|alert\s+triage\s+notes|(?:tier|L)\s?[123]\s+analyst\s+notes)\b

Corroborative evidence keywords

true positive, false positive, escalated, containment, EDR, SIEM, Sentinel, Splunk, isolated, password reset

Proximity: 300 characters

Should match

• Please attach the SOC case notes to the monthly security report. — Discovery probe (65)
• SOC case notes Case ID: SOC-26-04471 Severity: High — Medium-tier probe (75) - populated case fields
• SOC case notes - L2 analyst Case ID: SOC-26-04471 Affected host: ws-fin-114.harbour.internal Username: ateston Source IP: 10.20.4.17 2026-09-18 02:14 - EDR flagged encoded PowerShell; escalated to IR, host isolated, true positive; password reset requested. — High-tier probe (85) - several case fields, IP/timestamp artefacts and triage outcome

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: SOC case notes must record the disposition and be retained for seven years. — Policy text
• SOC case notes template Case ID: ________ Severity: [insert] Affected host: ________ — Blank template
• Course module 3: writing analyst notes - Case ID: SOC-00001, Source IP: 10.0.0.1, true positive. — Training framing

Known false positives

• SOC runbooks describe case fields. Mitigation: Fields must be populated; blank templates and guidance/training framing are excluded.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• Privacy Act 1988 (Cth)