# Add attack-technique context to a security alert

Send a security alert as JSON from your detection tool through the API. The agent suggests the MITRE ATT&CK tactic and technique the alert most likely represents, lists first triage steps for the analyst, and posts the enriched alert to a webhook you choose. The mapping comes from the model's own knowledge of ATT&CK, with no ATT&CK database attached, so an analyst should confirm it.

**Use cases:** Security, Monitoring and alerts

**Tags:** MITRE ATT&CK, SIEM, EDR, SOC, alert triage, enrichment, incident response, webhook

[Create this agent](https://seclai.com/agent-examples/create/security_alert_attack_context)

## How it starts

Trigger: dynamic input.

## What it needs

No knowledge base, memory bank or connection to create first.

## Steps

- Map to ATT&CK and suggest triage
- Parse and validate the context
- Post the enriched alert
- Show the context