def calculate_alert_priority(alert: dict, threat_intel: dict, asset_db: dict) -> int:
    score = 0
    
    # Base severity
    severity_scores = {"critical": 100, "high": 70, "medium": 40, "low": 10}
    score += severity_scores.get(alert["severity"], 0)
    
    # Asset criticality boost
    asset = asset_db.get(alert["asset_id"], {})
    if asset.get("criticality") == "high":
        score += 50
    elif asset.get("criticality") == "medium":
        score += 20
    
    # Threat intel boost
    if alert.get("src_ip") in threat_intel.get("known_c2_ips", []):
        score += 80
    if alert.get("file_hash") in threat_intel.get("known_malware_hashes", []):
        score += 100
    
    return min(score, 250)  # cap at 250

SOC Operations — Security Operations Center

SOC Operations — Security Operations Center

SOC Operations — Security Operations Center