SOCRadar Alert Passthrough

Description

Surfaces all open SOCRadar security incidents as Panther alerts. Severity is mapped dynamically from SOCRadar's alarm_risk_level (CRITICAL/HIGH/MEDIUM/LOW/INFO). SOCRadar performs the underlying threat detection; this rule ensures every open incident is visible in Panther for triage and response.

Query · python

def rule(event):
    return event.get("status") != "CLOSED"


def title(event):
    main_type = event.deep_get("alarm_type_details", "alarm_main_type", default="Unknown")
    sub_type = event.deep_get("alarm_type_details", "alarm_sub_type", default="")
    risk = event.get("alarm_risk_level", "UNKNOWN")
    return f"SOCRadar {risk} [{main_type} - {sub_type}]"


def severity(event):
    return event.get("alarm_risk_level", "DEFAULT").upper()


def dedup(event):
    return str(event.get("alarm_id", ""))


def alert_context(event):
    context = {
        "alarm_id": event.get("alarm_id"),
        "alarm_asset": event.get("alarm_asset"),
        "alarm_text": event.get("alarm_text"),
        "main_type": event.deep_get("alarm_type_details", "alarm_main_type"),
        "sub_type": event.deep_get("alarm_type_details", "alarm_sub_type"),
        "status": event.get("status"),
        "mitigation": event.deep_get("alarm_type_details", "alarm_default_mitigation_plan"),
    }

    content = event.get("content") or {}
    for field in (
        "content_link",
        "phishing_domain",
        "phishing_domain_url",
        "compromised_emails",
        "compromised_ips",
        "compromised_domains",
        "malware_family",
        "computer_name",
        "username",
        "source",
        "content_preview",
    ):
        if content.get(field):
            context[field] = content[field]

    return context

Analyst notes

Review the full alert context including alarm_id, alarm_type_details.alarm_main_type, alarm_type_details.alarm_sub_type, and all content fields (phishing_domain, compromised_emails, malware_family, content_link) to understand the nature and scope of the SOCRadar incident.
Check whether any extracted indicators (p_any_ip_addresses, p_any_domain_names, p_any_emails, p_any_usernames) appear in other log sources or security alerts in the 24 hours before and after this alert to determine if the threat has already reached internal systems.
Search for other SOCRadar incidents with the same alarm_type_details.alarm_main_type or alarm_asset in the past 30 days to identify whether this is an isolated finding or part of a recurring or escalating threat pattern.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: 2026-03-26
Modified: 2026-03-26
Authored by: panther-labs
Source ID
Upstream: rules/socradar_rules/socradar_alert_passthrough.yml
Type: rule
Version: 1
References: https://socradar.io/incident-response/
Data sources: SOCRadar.Incidents