rod-trent/SIEMTriage ? reverse-engineered prompt

Build me an AI SOC triage app for Microsoft Sentinel and Defender XDR that helps a junior analyst handle incidents faster.

I want to paste in an incident ID and have the app pull the incident details, enrich the users, IPs, domains, and hashes, run targeted hunts, then return a clear verdict with confidence, evidence, and a suggested deep dive plan. It should stream the agent’s progress live so I can watch what it is doing, and I want a simple UI where I can see the incident queue, the full incident page, and a metrics page for eval results.

Please make it safe by keeping it read only, so it never closes incidents or takes response actions on its own, only recommends what to do next. If you need to look up current docs online, go ahead. Also include a demo mode with fixture data, and a full local setup with a database and queue so I can run it end to end on my machine.