{
  "format": "minctrl.process/v1",
  "graph": {
    "edges": [
      {
        "id": "e0___start____intake",
        "source": "__start__",
        "target": "intake"
      },
      {
        "id": "e1_intake__fork-triage",
        "source": "intake",
        "target": "fork-triage"
      },
      {
        "id": "e2_fork-triage__investigate",
        "source": "fork-triage",
        "target": "investigate"
      },
      {
        "id": "e3_fork-triage__forensics",
        "source": "fork-triage",
        "target": "forensics"
      },
      {
        "id": "e4_investigate__join-triage",
        "source": "investigate",
        "target": "join-triage"
      },
      {
        "id": "e5_forensics__join-triage",
        "source": "forensics",
        "target": "join-triage"
      },
      {
        "id": "e6_join-triage__verdict",
        "source": "join-triage",
        "target": "verdict"
      },
      {
        "id": "e7_verdict__autoclose",
        "label": "benign / false positive",
        "source": "verdict",
        "target": "autoclose"
      },
      {
        "id": "e8_verdict__signoff",
        "label": "confirmed / suspected incident",
        "source": "verdict",
        "target": "signoff"
      },
      {
        "id": "e9_signoff__analyst-call",
        "source": "signoff",
        "target": "analyst-call"
      },
      {
        "id": "e10_analyst-call__investigate",
        "label": "needs deeper investigation — re-triage",
        "source": "analyst-call",
        "target": "investigate"
      },
      {
        "id": "e11_analyst-call__autoclose",
        "label": "overridden as benign",
        "source": "analyst-call",
        "target": "autoclose"
      },
      {
        "id": "e12_analyst-call__respond",
        "label": "authorize containment",
        "source": "analyst-call",
        "target": "respond"
      },
      {
        "id": "e13_autoclose__monitor",
        "source": "autoclose",
        "target": "monitor"
      },
      {
        "id": "e14_respond__monitor",
        "source": "respond",
        "target": "monitor"
      },
      {
        "id": "e15_monitor____end__",
        "source": "monitor",
        "target": "__end__"
      }
    ],
    "nodes": [
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "__start__",
        "interrupt_before": false,
        "kind": "terminal",
        "label": "Start",
        "position": {
          "x": 0,
          "y": 0
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "terminal",
        "tools": []
      },
      {
        "agent": "intake",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "intake",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Ingest the alert and telemetry from the SIEM / EDR",
        "position": {
          "x": 0,
          "y": 120
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "siem",
          "edr"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "parallel",
        "human": null,
        "id": "fork-triage",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Enrich and preserve evidence concurrently",
        "position": {
          "x": 0,
          "y": 240
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": "investigate",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "investigate",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Enrich, correlate and investigate the alert against threat intelligence",
        "position": {
          "x": 0,
          "y": 360
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "threat-intel"
        ]
      },
      {
        "agent": "compliance",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "forensics",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Score severity, preserve forensic evidence, and stage the response playbook",
        "position": {
          "x": 0,
          "y": 480
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "soar"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "parallel",
        "human": null,
        "id": "join-triage",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Combine enrichment and forensic findings into a written verdict",
        "position": {
          "x": 0,
          "y": 600
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "exclusive",
        "human": null,
        "id": "verdict",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Confirmed incident?",
        "position": {
          "x": 0,
          "y": 720
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": "investigate",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "autoclose",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Auto-close the benign / false-positive alert and write the verdict to the case",
        "position": {
          "x": 0,
          "y": 840
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "psa-ticketing"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": "gate:ir-containment-signoff",
        "gateway": null,
        "human": "Certified SOC analyst (incident responder)",
        "id": "signoff",
        "interrupt_before": true,
        "kind": "gate",
        "label": "A certified SOC analyst reviews the verdict and either authorizes containment / host isolation / breach notification, sends it back for deeper investigation, or overrides it as benign",
        "position": {
          "x": 0,
          "y": 960
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": []
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "exclusive",
        "human": null,
        "id": "analyst-call",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Analyst's call?",
        "position": {
          "x": 0,
          "y": 1080
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": "respond",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "respond",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Execute the approved containment and isolate the affected hosts",
        "position": {
          "x": 0,
          "y": 1200
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": [
          "soar",
          "edr"
        ]
      },
      {
        "agent": "monitor",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "monitor",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Verify remediation, open the ticket, and log for the SOC 2 audit trail",
        "position": {
          "x": 0,
          "y": 1320
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "psa-ticketing"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "__end__",
        "interrupt_before": false,
        "kind": "terminal",
        "label": "Done",
        "position": {
          "x": 0,
          "y": 1440
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "terminal",
        "tools": []
      }
    ]
  },
  "hash": "640642216f4dba5b0ba79560788e15bd9e546e12008733e05fd0a1133934dfed",
  "name": "Managed-SOC / MDR autopilot",
  "slug": "soc",
  "source": "example",
  "version": null,
  "violations": []
}