AirMDR: A New Approach to Managed Detection and Response
Audit your MDR with SOC Grader
- Select 10 pairs of: Alert + Case write-up
10 minutes - Upload those to the SOC Grader Tool
10 sec/case - Review the Case write-up Grades
2 min/case
Get Detailed Reports so You Can Improve Case Quality
SOC Grader:
- Dynamically generates questions analysts should answer during an investigation
- Assesses how well your case write-up answered the questions
- Scores the case write-up based on question criticality and answer thoroughness
- Generates a detailed quality assessment report for every case write-up
Questions that a good investigation should answer
| Question | Weight | Answer Status |
|---|---|---|
| Are the flagged AWS API calls actually first-time actions for this user account based on historical CloudTrail data? | 5 | Partially Answered, Critical Gap |
| What is the user's typical pattern of AWS API usage and administrative responsibilities? | 5 | Not Answered, Critical Gap |
| Is the source IP address and geolocation consistent with the user's expected access patterns? | 3 | Partially Answered, Critical Gap |
| Does the user have legitimate business justification and appropriate permissions for the AWS services accessed? | 3 | Not Answered, Critical Gap |
| Are there any threat intelligence indicators associated with the source IP, user agent, or API call patterns? | 1 | Partially Answered, Critical Gap |
| Is the user account showing any indicators of compromise in recent activity logs? | 5 | Partially Answered |
| Are there any anomalies in the authentication method, MFA status, or session characteristics? | 3 | Partially Answered |
| What specific AWS resources and data did the user access or enumerate through these API calls? | 3 | Partially Answered |
| Did the first-seen API calls occur in rapid succession or follow any suspicious timing patterns? | 3 | Partially Answered |
Ready to Grade a SOC Case? AI-Powered Security Operations
Get an instant case-quality score
and actionable feedback using a transparent rubric.
Need more detail first?
Why and How to Measure Case Quality (eBook)
Manual Scoring Toolkit (How-To + Calculator)
SecOps LLM Prompts (Reference Card)