القائمة
Use when reading a JIRA security ticket to extract CVE IDs, affected systems, and metadata for vulnerability analysis or event investigation.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.
Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.
Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.
Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.
Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.
| name | read-ticket |
| description | Use when reading a JIRA security ticket to extract CVE IDs, affected systems, and metadata for vulnerability analysis or event investigation. |
| argument-hint | <ticket-id> |
Read a JIRA security ticket via jr CLI, extract CVE IDs and affected system metadata.
jr CLI installed and authenticated (jr auth login){PROJECT_KEY}-{NUMBER} format{PROJECT_KEY}-{NUMBER}jr issue view <ticket-id>
CVE-\d{4}-\d{4,7} from summary, description, custom fieldsjr issue assets <ticket-id>
ticket_id: '{ticket_id}'
summary: '{summary}'
description: '{description}'
cve_ids:
primary: '{primary_cve}'
all: ['{cve_1}', ...]
affected_systems: ['{system_1}', ...]
asset_criticality: '{rating}'
system_exposure: '{exposure}'
priority: '{priority}'
linked_assets: ['{asset_key}', ...]
jr auth login to authenticate with JIRA"jr issue list --jql "key = <id>"