Audit your MDR with SOC Grader

1. Select 10 pairs of: Alert + Case write-up
   10 minutes
2. Upload those to the SOC Grader Tool
   10 sec/case
3. Review the Case write-up Grades
   2 min/case

Get Detailed Reports so You Can Improve Case Quality

SOC Grader:

• Dynamically generates questions analysts should answer during an investigation
• Assesses how well your case write-up answered the questions
• Scores the case write-up based on question criticality and answer thoroughness
• Generates a detailed quality assessment report for every case write-up

Questions that a good investigation should answer

1. Are the flagged AWS API calls actually first-time actions for this user account based on historical CloudTrail data?

   • Weight: 5
   • Partially Answered
   • Critical Gap

2. What is the user's typical pattern of AWS API usage and administrative responsibilities?

   • Weight: 5
   • Not Answered
   • Critical Gap

3. Is the source IP address and geolocation consistent with the user's expected access patterns?

   • Weight: 3
   • Partially Answered
   • Critical Gap

4. Does the user have legitimate business justification and appropriate permissions for the AWS services accessed?

   • Weight: 3
   • Not Answered
   • Critical Gap

5. Are there any threat intelligence indicators associated with the source IP, user agent, or API call patterns?

   • Weight: 1
   • Partially Answered
   • Critical Gap

6. Is the user account showing any indicators of compromise in recent activity logs?

   • Weight: 5
   • Partially Answered

7. Are there any anomalies in the authentication method, MFA status, or session characteristics?

   • Weight: 3
   • Partially Answered

8. What specific AWS resources and data did the user access or enumerate through these API calls?

   • Weight: 3
   • Partially Answered

9. Did the first-seen API calls occur in rapid succession or follow any suspicious timing patterns?

   • Weight: 3
   • Partially Answered

Ready to Grade a SOC Case?

Get an instant case-quality score
and actionable feedback using a transparent rubric.

Need more detail first?

Why and How to Measure Case Quality (eBook)

Manual Scoring Toolkit (How-To + Calculator)

SecOps LLM Prompts (Reference Card)

Find a time to meet with AirMDR

August 2026

Select a day in August

Now displaying available times for August 7th.

How long do you need?

• 30 mins
• 15 mins

Now displaying start times for 30 mins blocks available on August 7th.

What time works best?

Showing times for August 7, 2026

• 1:15 pm
• 2:30 pm
• 2:45 pm
• 3:00 pm
• 3:15 pm
• 3:30 pm
• 3:45 pm
• 4:00 pm
• 4:15 pm
• 4:30 pm
• 4:45 pm
• 5:00 pm
• 5:15 pm
• 5:30 pm
• 5:45 pm
• 6:00 pm
• 6:15 pm
• 6:30 pm
• 6:45 pm
• 7:00 pm
• 7:15 pm
• 7:30 pm
• 7:45 pm
• 8:00 pm
• 8:15 pm
• 8:30 pm
• 8:45 pm
• 9:00 pm
• 9:15 pm
• 9:30 pm