| name | orca-morning-briefing |
| description | Daily security briefing summarizing new critical alerts, attack paths, compliance drift, exposure changes, and aging unactioned alerts from the last 24-72 hours. Use when user asks for a briefing, summary, or overview (e.g., "morning briefing", "what happened", "security summary", "daily report", "what needs attention"). |
| trigger | When user asks for a morning briefing, daily summary, overnight changes, security status, what happened overnight, what's new, environment health, or "brief me" (e.g., "morning briefing", "what happened overnight?", "daily security summary", "brief me on the last 72 hours") |
Orca Morning Briefing Skill
Answers the question: "What happened while I was away, and what needs my attention?"
Provides a security briefing for the last 24-72 hours covering new critical alerts, escalated alerts, attack path changes, compliance drift, exposure changes, CDR activity anomalies, crown jewel risks, and aging unactioned alerts.
Usage
/orca-morning-briefing
/orca-morning-briefing 72h
/orca-morning-briefing week
Or natural language:
- "morning briefing"
- "what happened overnight?"
- "brief me on the last 72 hours"
- "daily security summary"
- "what's new since yesterday?"
Time Range
| Argument | Period | When to Use |
|---|
| (none) | Last 24 hours | Daily morning check |
72h | Last 3 days | Monday morning / after weekend |
week | Last 7 days | Weekly review / returning from PTO |
Map these to CDR time_range enum values:
- 24h →
"last_24_hours"
- 72h →
"last_3_days"
- week →
"last_7_days"
Processing Logic
Data Gathering Phase
Run ALL of the following queries in parallel to minimize latency. Do not wait for one to finish before starting the next.
Group 1: Alert Queries (via discovery_search)
Run these discovery_search queries in parallel:
Query 1a: New critical alerts
discovery_search:
search_phrase: "critical open alerts"
limit: 10
Query 1b: New high alerts
discovery_search:
search_phrase: "high severity open alerts"
limit: 10
Query 1c: Alerts on crown jewel assets
discovery_search:
search_phrase: "open alerts on crown jewel assets"
limit: 10
Query 1d: Internet-facing assets with critical vulnerabilities
discovery_search:
search_phrase: "internet facing assets with critical vulnerabilities"
limit: 10
Query 1e: New attack paths
discovery_search:
search_phrase: "critical attack paths"
limit: 10
Group 2: Compliance Queries
Run these in parallel:
Query 2a: Current compliance scores
get_enabled_compliance_frameworks:
(no filters — get all frameworks)
Query 2b: Compliance trend
get_compliance_trend_over_time:
filters:
datetime_filter: 7 (or 14/30 depending on time range)
Query 2c: Compliance by account
get_compliance_analysis_by_account_or_business_unit:
group_by: "accounts"
Group 3: CDR Activity
Run these in parallel:
Query 3a: CDR events grouped by action (last 24h)
get_cdr_events_grouped_by_event_name:
time_range: "last_24_hours" (or "last_3_days" / "last_7_days")
page_size: 50
Query 3b: CDR events from unusual sources
search_cdr_events:
time_range: "last_24_hours" (or "last_3_days" / "last_7_days")
limit: 50
Analysis Phase
After all queries return, analyze and synthesize:
1. New Alerts Analysis
From discovery_search results for critical and high alerts:
- Count total new alerts by severity
- Filter to alerts whose
CreatedAt falls within the requested time window
- For alerts that were already shown in previous briefings but were reopened or escalated, flag as "ESCALATED" or "REOPENED"
- Identify any alert types that appear for the first time (compare alert type names against the full list — if it's the first time this
AlertType appears, flag as "NEW TYPE")
- Sort by Orca Score descending
2. Attack Path Analysis
From discovery_search attack path results:
- Count attack paths by severity
- Identify any that involve crown jewel assets
- Look for attack paths with stories involving lateral movement, privilege escalation, or data exfiltration
3. Compliance Drift Detection
From compliance framework results:
- Compare current scores against trend data
- Flag any framework that DROPPED in score (even 1%)
- Highlight frameworks below organizational thresholds (e.g., < 90%)
- Identify the account(s) dragging scores down (from account heatmap)
4. CDR Activity Analysis
From CDR event aggregation:
- Identify high-volume event types (top 10 by count)
- Flag events from unusual actors or IP addresses
- Look for patterns suggesting:
- Bulk resource changes (many Create*/Delete*/Modify* events)
- Reconnaissance (many Describe*/List*/Get* calls from one actor)
- Privilege escalation attempts (IAM policy changes, role assumptions)
- Data access spikes (S3 GetObject, database queries)
Classify CDR activity into:
Category Event Patterns Concern Level
────────────────────────────────────────────────────────────────────
Normal operations Describe*, List*, Get* (read) LOW
Resource changes Create*, Put*, Modify*, Update* MEDIUM
Deletions Delete*, Remove*, Terminate* HIGH
IAM changes Attach*Policy, Create*Role, HIGH
PutRolePolicy, AssumeRole
Security changes AuthorizeSecurityGroup*, HIGH
PutBucketPolicy, ModifyVpc*
Console logins ConsoleLogin from new IPs MEDIUM-HIGH
Root account usage Any action by root account CRITICAL
5. Exposure Changes
From discovery_search internet-facing results:
- Identify assets that are public-facing with high/critical alerts
- Cross-reference with crown jewel status
6. Crown Jewel Risk
From discovery_search crown jewel results:
- Count alerts on crown jewel assets by severity
- Flag any crown jewel with NEW critical alerts
7. Aging Alert Detection
From all alert results, identify:
- Critical alerts open > 7 days
- Critical alerts open > 30 days (severe aging)
- Alerts that were dismissed and reopened (remediation friction)
- Alerts with Jira tickets stuck in "To Do" status
8. Environment Pulse Calculation
Calculate the overall environment health:
IF new_critical_alerts > 0 AND (crown_jewel_affected OR compliance_dropped) THEN
pulse = "🔴 DEGRADING — immediate attention needed"
ELSE IF new_critical_alerts > 0 OR compliance_dropped THEN
pulse = "⚠️ NEEDS ATTENTION — new critical findings"
ELSE IF new_high_alerts > 3 THEN
pulse = "⚠️ ELEVATED — review high-severity queue"
ELSE IF aging_criticals > 0 THEN
pulse = "⏳ STALE — no new threats but unresolved criticals aging"
ELSE
pulse = "✅ STABLE — no significant changes"
Output Format
Layer 1: Dashboard (always shown)
═══════════════════════════════════════════════════════════════════
MORNING BRIEFING — <date>
Last <time_range> | <account(s)>
═══════════════════════════════════════════════════════════════════
PULSE: <environment health assessment — 1 line>
┌─────────────────────────────────────────────────────────────────┐
│ NEW ALERTS <N> total (<X> critical, <Y> high) │
│ ESCALATED <N> alerts changed severity or reopened │
│ ATTACK PATHS <N> new or worsened │
│ COMPLIANCE <framework> dropped <X>% │
│ EXPOSURE <N> assets newly internet-facing │
│ CROWN JEWELS <N> new alerts on critical assets │
│ AGING CRITICALS <N> critical alerts open > 7 days │
│ CDR ACTIVITY <volume assessment — normal/elevated/spike> │
└─────────────────────────────────────────────────────────────────┘
TOP PRIORITIES:
[1] <alert-id> — <title> (<score>, <age>)
[2] <alert-id> — <title> (<score>, <age>)
[3] <alert-id> — <title> (<score>, <age>)
[4] <alert-id> — <title> (<score>, <age>)
[5] <alert-id> — <title> (<score>, <age>)
═══════════════════════════════════════════════════════════════════
Type a keyword to drill down: alerts | escalated | attack paths |
compliance | exposure | crown jewels | aging | activity |
new types | trends | full
═══════════════════════════════════════════════════════════════════
The TOP PRIORITIES list should be ordered by:
- New critical alerts on crown jewel or public-facing assets
- New critical alerts (by Orca Score descending)
- Escalated alerts (severity increased)
- Reopened alerts that were previously dismissed
- Aging critical alerts (oldest first)
Show up to 5 items. If fewer than 5 priorities, show fewer.
Layer 2: Drill-Down Sections
When user types a keyword, show the expanded section:
"alerts" — New Alerts Detail
───────────────────────────────────────────────────────────────────
NEW ALERTS — last <time_range>
───────────────────────────────────────────────────────────────────
CRITICAL (<N>):
<alert-id> <score> <title>
<asset> in <account> | <age> | <labels>
<alert-id> <score> <title>
<asset> in <account> | <age> | <labels>
HIGH (<N>):
<alert-id> <score> <title>
<asset> in <account> | <age> | <labels>
...
NEW ALERT TYPES (first time in environment):
⚡ <alert-type> — never seen before (orca-XXXX on <asset>)
───────────────────────────────────────────────────────────────────
Triage any alert: /orca-alert-triage <alert-id>
───────────────────────────────────────────────────────────────────
"escalated" — Escalated Alerts
───────────────────────────────────────────────────────────────────
ESCALATED ALERTS — last <time_range>
───────────────────────────────────────────────────────────────────
SEVERITY INCREASED:
<alert-id> <old-level> → <new-level> <title>
Reason: <score vector change>
REOPENED (was closed/dismissed):
<alert-id> dismissed → open <title>
<asset> | originally opened <date>
───────────────────────────────────────────────────────────────────
"attack paths" — Attack Path Changes
───────────────────────────────────────────────────────────────────
ATTACK PATHS — last <time_range>
───────────────────────────────────────────────────────────────────
NEW ATTACK PATHS:
[!] <score> <attack path story — 1 line>
Assets: <list> | Kill chain: <step count>
Crown jewel involved: YES/NO
WORSENED:
[↑] <score> <attack path story>
Change: <what got worse>
───────────────────────────────────────────────────────────────────
"compliance" — Compliance Drift
───────────────────────────────────────────────────────────────────
COMPLIANCE POSTURE — last <time_range>
───────────────────────────────────────────────────────────────────
FRAMEWORK SCORES:
Framework Score 7-Day Trend Status
─────────────────────────────────────────────────────────
PCI DSS v4.0.1 87% ↓ -2% ⚠ DROPPED
NIST 800-53 93% → 0% ✓ STABLE
SOC 2 95% ↑ +1% ✓ IMPROVING
CIS AWS v3.0 81% ↓ -1% ⚠ DROPPED
WORST ACCOUNTS:
<account> — <score>% avg across frameworks
<account> — <score>% avg across frameworks
NEW FAILING CONTROLS:
<framework>: <control> — <N> assets failing
...
───────────────────────────────────────────────────────────────────
"exposure" — Exposure Changes
───────────────────────────────────────────────────────────────────
EXPOSURE — Internet-Facing Assets with Critical Alerts
───────────────────────────────────────────────────────────────────
<asset> (<type>) in <account>
Public IP: <ip>
Critical alerts: <N> | Orca Score: <score>
Crown jewel: YES/NO
<asset> (<type>) in <account>
...
───────────────────────────────────────────────────────────────────
"crown jewels" — Crown Jewel Risk
───────────────────────────────────────────────────────────────────
CROWN JEWEL ALERTS — last <time_range>
───────────────────────────────────────────────────────────────────
<asset> (crown jewel score: <N>)
Reason: <why it's a crown jewel>
New alerts: <N> (<severity breakdown>)
Top alert: <alert-id> — <title> (score: <X>)
...
───────────────────────────────────────────────────────────────────
"aging" — Unactioned Aging Alerts
───────────────────────────────────────────────────────────────────
AGING ALERTS — Critical Alerts Needing Attention
───────────────────────────────────────────────────────────────────
CRITICAL > 30 DAYS (urgent):
<alert-id> <age>d <title>
<asset> | Jira: <ticket> (<status>)
CRITICAL > 7 DAYS:
<alert-id> <age>d <title>
<asset> | Jira: <ticket> (<status>)
DISMISSED → REOPENED (remediation friction):
<alert-id> <title>
dismissed <date>, reopened <date>
JIRA STUCK:
<alert-id> Jira <ticket> in "<status>" for <N> days
<title>
───────────────────────────────────────────────────────────────────
"activity" — CDR Activity Overview
───────────────────────────────────────────────────────────────────
CDR ACTIVITY — last <time_range>
───────────────────────────────────────────────────────────────────
VOLUME: <total events> events (<assessment>)
TOP EVENTS BY VOLUME:
<event_name> <count> <assessment>
<event_name> <count> <assessment>
...
HIGH-INTEREST ACTIVITY:
[!] <description of suspicious pattern>
Actor: <identity> | Count: <N> | Service: <service>
[!] <description>
...
UNUSUAL ACTORS (if any):
<actor> — <N events>, services: <list>
First seen in this period: YES/NO
───────────────────────────────────────────────────────────────────
"new types" — First-Time Alert Types
───────────────────────────────────────────────────────────────────
NEW ALERT TYPES — First Time in Environment
───────────────────────────────────────────────────────────────────
⚡ <alert-type>
First occurrence: <alert-id> on <asset>
Severity: <level> | Score: <X.X>
What it means: <1-line explanation>
⚡ <alert-type>
...
(If none): No new alert types detected in this period.
───────────────────────────────────────────────────────────────────
"trends" — Week-Over-Week Trends
───────────────────────────────────────────────────────────────────
TRENDS — Environment Over Time
───────────────────────────────────────────────────────────────────
ALERT TREND (7-day):
Day Critical High Medium Total
──────────────────────────────────────────
Mon Apr 14 2 5 12 19
Tue Apr 15 1 3 8 12
...
Today 3 4 5 12
DIRECTION: <improving / degrading / stable>
TOP 5 MOST-AFFECTED ASSETS:
<asset> — <N> open alerts (<X> critical)
<asset> — <N> open alerts (<X> critical)
...
TOP 3 MOST-AFFECTED ACCOUNTS:
<account> — <N> critical alerts, compliance: <score>%
...
───────────────────────────────────────────────────────────────────
"full" — Everything Expanded
Show all sections above in order:
- Dashboard (repeated for context)
- New Alerts
- Escalated
- Attack Paths
- Compliance
- Exposure
- Crown Jewels
- Aging
- Activity
- New Types
- Trends
This is the "report mode" — useful for sharing with the team or pasting into a status update.
Edge Cases
No New Alerts
If no new critical/high alerts in the time window:
PULSE: ✅ STABLE — no new critical or high alerts
NEW ALERTS: 0 critical, 0 high
(Last critical alert was <N> days ago: <alert-id>)
Still show aging alerts, compliance, and CDR activity — the absence of new alerts doesn't mean everything is fine.
discovery_search Returns Partial Data
discovery_search is limited to 10 results per query. If results are capped:
- Note "showing top 10 of potentially more"
- Include the Orca UI URL for the full filtered view when available (from
app_url in results)
- For alert counts, qualify with "at least N" rather than exact numbers
No Compliance Frameworks Enabled
If get_enabled_compliance_frameworks returns empty:
COMPLIANCE: No frameworks enabled.
Consider enabling PCI DSS, SOC 2, or CIS benchmarks.
CDR Not Configured
If CDR queries return 0 events:
CDR ACTIVITY: No events found.
Possible reasons:
• CloudTrail / audit log ingestion not configured
• CDR not enabled for this account
First Briefing (No Baseline)
On the first run, there's no historical baseline to compare against. Note this:
Note: This is the first briefing for this environment.
Future briefings will show trends and comparisons.
MCP Tools Used
Primary Tools (always called)
| Tool | Purpose | Briefing Section |
|---|
discovery_search | Find new critical alerts | New Alerts, Crown Jewels, Exposure |
discovery_search | Find new high alerts | New Alerts |
discovery_search | Find crown jewel alerts | Crown Jewels |
discovery_search | Find exposed assets | Exposure |
discovery_search | Find attack paths | Attack Paths |
get_enabled_compliance_frameworks | Current compliance scores | Compliance |
get_compliance_trend_over_time | Score trends (7/14/30 days) | Compliance, Trends |
get_cdr_events_grouped_by_event_name | Event volume by action type | CDR Activity |
Secondary Tools (called for drill-downs)
| Tool | Purpose | When Called |
|---|
get_compliance_analysis_by_account_or_business_unit | Account-level compliance breakdown | "compliance" drill-down |
get_compliance_framework_control_tests | Failing controls per framework | "compliance" drill-down |
search_cdr_events | Detailed event inspection | "activity" drill-down |
get_alert | Full alert details | When user triages from briefing |
get_asset_crown_jewel_info | Crown jewel status for specific asset | "crown jewels" drill-down |
get_framework_assets_with_failed_controls_count | Worst assets per framework | "compliance" drill-down |
Tool Parameter Reference
discovery_search
| Parameter | Type | Required | Description |
|---|
search_phrase | string | Yes | Natural language query |
limit | integer (1-10) | No | Max results (default: 5) |
get_enabled_compliance_frameworks
| Parameter | Type | Required | Description |
|---|
filters | object | No | Contains datetime_filter (7/14/30), providers, accounts, framework_ids, etc. |
get_compliance_trend_over_time
| Parameter | Type | Required | Description |
|---|
filters | object | No | Same shape as compliance frameworks filters |
get_compliance_analysis_by_account_or_business_unit
| Parameter | Type | Required | Description |
|---|
group_by | enum | No | "accounts" or "business_units" (default: "business_units") |
framework_ids | array | No | Filter to specific frameworks |
get_cdr_events_grouped_by_event_name
| Parameter | Type | Required | Description |
|---|
time_range | enum | Yes | "last_1_hour", "last_24_hours", "last_3_days", "last_7_days", "last_30_days" |
cloud_providers | array | No | Filter by provider |
accounts | array | No | Filter by account |
actors | array | No | Filter by actor |
services | array | No | Filter by service |
page_size | integer (1-100) | No | Results per page (default: 15) |
search_cdr_events
| Parameter | Type | Required | Description |
|---|
time_range | enum | Yes | Same as above |
actors | array | No | Filter by actor ARNs |
targets | array | No | Filter by target resources |
services | array | No | Filter by service |
actions | array | No | Filter by event name |
source_ip_addresses | array | No | Filter by source IP |
limit | integer (1-100) | No | Max events (default: 20) |
All array parameters must be arrays, even for single values: ["value"] not "value".
Implementation Notes
- Parallelize everything — run all Group 1, 2, and 3 queries simultaneously. The briefing should complete in a single round of parallel MCP calls.
- discovery_search is capped at 10 results — qualify counts with "at least N" and include Orca UI URLs for full views.
- Time filtering —
discovery_search does not have an explicit time parameter. Use time-related language in the search phrase (e.g., "critical alerts created in the last 24 hours"). For CDR and compliance tools, use their native time filters.
- Alert deduplication — the same alert may appear in multiple discovery_search results (e.g., a critical alert on a crown jewel). Deduplicate by alert_id before counting.
- Compliance trend interpretation —
get_compliance_trend_over_time returns data points over time. Compare the latest score against the score from N days ago to calculate drift.
- CDR volume assessment — without historical baselines, use absolute thresholds:
- < 100 events/day → LOW
- 100-1000 events/day → NORMAL
- 1000-10000 events/day → ELEVATED
- > 10000 events/day → HIGH VOLUME
These are rough guidelines — adjust based on environment size.
- Keep the dashboard under 25 lines — the whole point is quick scanning. Details go in drill-downs.
- Top priorities list — always show the single most important thing to do first. This is the briefing's core value.
- Link to other skills — when showing alerts in drill-downs, suggest
/orca-alert-triage <alert-id> for investigation, /orca-impact-analysis <alert-id> for remediation planning, and /orca-config-origin <alert-id> for ownership.
