القائمة
Use when adding case comments, tags, or status updates to document actions in SOAR.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/dandye/adk_runbooks --skill document-in-soarيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.
Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.
Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.
| name | document-in-soar |
| description | Use when adding case comments, tags, or status updates to document actions in SOAR. |
| category | common |
| version | 1.0.0 |
| type | Skill |
| title | Skill: Common Step: Document Findings/Actions in SOAR Case |
| generated | {"by":"human:dandye","at":"2025-11-10T22:21:35.000Z"} |
Add a standardized comment to a specified SOAR case to document findings, actions taken, or recommendations.
This sub-runbook executes the post_case_comment action in the SOAR platform. It assumes the comment content is provided by the calling runbook.
${CASE_ID}: The SOAR case ID to add the comment to.${COMMENT_TEXT}: The full text of the comment to be added.${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers if required by the specific SOAR tool implementation, passed from the calling runbook.${COMMENT_POST_STATUS}: Confirmation or status of the comment posting attempt (e.g., Success, Failure, API response).secops-soar: post_case_comment${CASE_ID}, ${COMMENT_TEXT}, and optionally ${ALERT_GROUP_IDENTIFIERS} from the calling runbook.soar-mcp_post_case_comment with case_id=${CASE_ID} and comment=${COMMENT_TEXT} (and alert_group_identifiers if needed).${COMMENT_POST_STATUS} and return it to the calling runbook.sequenceDiagram
participant CallingRunbook
participant DocumentInSOAR as document_in_soar.md (This Runbook)
participant SOAR as secops-soar
CallingRunbook->>DocumentInSOAR: Execute Documentation\nInput: CASE_ID, COMMENT_TEXT, ALERT_GROUP_IDS (opt)
%% Step 2: Post Comment
DocumentInSOAR->>SOAR: post_case_comment(case_id=CASE_ID, comment=COMMENT_TEXT, ...)
SOAR-->>DocumentInSOAR: Comment Post Result (COMMENT_POST_STATUS)
%% Step 3: Return Status
DocumentInSOAR-->>CallingRunbook: Return Status:\nCOMMENT_POST_STATUS
The post_case_comment action has been attempted. The status (${COMMENT_POST_STATUS}) is available.