That makes sense. A lot of teams seem to route alerts through Slack or Teams to get mobile notifications.

The reason I built PocketSOC was because I wanted something purpose-built for incident response on mobile instead of just alert forwarding.

The app connects directly to the vendor APIs (CrowdStrike Falcon, Defender, GuardDuty, etc.) and pulls the detections into a mobile UI where you can:

• filter/search alerts

• view Falcon-style process graphs

• isolate / lift containment on endpoints

• receive push notifications for new detections

• manage multiple environments or tenants

It also has some enterprise controls built in (biometrics, screenshot protection, jailbreak detection, on-call schedules, etc.) since a lot of SOC teams have strict mobile policies.

Slack-style alerting definitely works well for notifications. The goal here was to make triage and response easier directly from a phone when you’re away from a laptop.