How to use the SOC Escalation Matrix Builder agent skill

What the skill makes the agent do

Once the skill is installed, the agent can draft a complete SOC escalation matrix. That includes severity tiers, the analyst tier responsible for each, notification steps and message templates. The skill's source describes context-driven escalation, which combines business risk, asset criticality and data sensitivity instead of severity alone. The escalation decision matrix in the source, for example, rates an incident as P1 when a Critical severity meets High or Critical asset criticality.

The skill also includes two Python scripts, scripts/agent.py and scripts/process.py, that build and simulate these matrices. The skill is a planning aid. It produces documents and generic logic, not real-time response decisions.

Install the skill from the ZIP download

Download the ZIP for this skill from this page and unzip it. Then place the resulting folder in one of two locations: ~/.claude/skills/ to make it available across your projects, or .claude/skills/ inside a specific project folder to limit it to that project.

You can also upload the skill in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project

Trigger the skill with a natural request

You do not need to type a special command. The skill's description says to use it when designing or revising how a SOC triages and escalates incidents across analyst tiers, so ask for that work in plain language. Name the goal, your context and the output you want.

Good requests name the situation: a new SOC, a revised triage policy, a SOAR playbook with escalation timers, or a training exercise. Mention your asset categories and data types if you want context-driven tiers rather than generic ones.

• Draft an escalation matrix for a 24/7 SOC with three analyst tiers, including P1 to P4 response and resolution times.
• Revise our P2 escalation rules so that executive account anomalies and domain controller alerts are escalated automatically.
• Create message templates for P1 and P2 incident notifications to management.
• Produce an SLA timer configuration for our SOAR escalation playbook, then explain each condition.
• Build a simulation of our escalation matrix using the included scripts and show me the output.

Review the default values before use

The SLAs, triggers and tier assignments in the skill are example values. The skill's own warnings say they must be validated against your organisation's policies and regulatory obligations. The default P1 response target is 15 minutes, the P2 target is 30 minutes and the P1 resolution target is 4 hours, but these are not recommendations for your organisation.

Treat the output as a draft for review by your SOC leadership, legal and compliance teams. Do not copy the default SLAs and triggers into production without checking them against your risk profile.

• Confirm each SLA against your contracts and regulatory duties.
• Check that auto-escalation triggers match the assets you actually have.
• Make sure named roles and contacts exist and are staffed for the hours you promise.

Run the included Python scripts

The skill requires Python 3.8+ to run its included scripts. The source does not name any other dependencies beyond Python 3.8+ and the prerequisite of an appropriate test or lab environment for safe execution. The files do not mention API keys or accounts.

The skill's references describe the priority tiers, alert categories and escalation chains that the scripts work from. Ask the agent to run the scripts against your own categories, then review the output before you adopt it.