{
  "id": "responsibility:security-incident-triage",
  "_kind": "Responsibility",
  "_file": "role/responsibilities/responsibilities-expanded-2.yaml",
  "_cluster": "role",
  "attributes": {
    "displayName": "Security incident triage",
    "cadence": "on-demand",
    "description": "Triage security alerts and incidents — classify severity, determine\nscope, coordinate initial response, and escalate to appropriate\nteams based on incident type and impact.\n"
  },
  "outgoingEdges": [
    {
      "from": "responsibility:security-incident-triage",
      "to": "role:soc-analyst",
      "kind": "held_by",
      "attributes": {}
    },
    {
      "from": "responsibility:security-incident-triage",
      "to": "role:threat-analyst",
      "kind": "held_by",
      "attributes": {}
    },
    {
      "from": "responsibility:security-incident-triage",
      "to": "role:blue-team-lead",
      "kind": "held_by",
      "attributes": {}
    },
    {
      "from": "responsibility:security-incident-triage",
      "to": "skill-area:security-monitoring-siem",
      "kind": "requires_expertise",
      "attributes": {}
    },
    {
      "from": "responsibility:security-incident-triage",
      "to": "skill-area:incident-response",
      "kind": "requires_expertise",
      "attributes": {}
    }
  ],
  "incomingEdges": [
    {
      "from": "role:threat-analyst",
      "to": "responsibility:security-incident-triage",
      "kind": "holds_responsibility"
    },
    {
      "from": "role:soc-analyst",
      "to": "responsibility:security-incident-triage",
      "kind": "holds_responsibility"
    },
    {
      "from": "role:blue-team-lead",
      "to": "responsibility:security-incident-triage",
      "kind": "holds_responsibility"
    },
    {
      "from": "workflow:security-incident-response",
      "to": "responsibility:security-incident-triage",
      "kind": "triggers_responsibility",
      "attributes": {}
    }
  ]
}