تشغيل أي مهارة في Manus بنقرة واحدة

rl-report

النجوم٠

التفرعات٠

آخر تحديث١٦ يوليو ٢٠٢٦ في ١٧:٥٩

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

reversinglabs

reversinglabs/rl-spectra-ai-soc

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

مطوّرو البرمجياتمهن الحاسوب والرياضيات·SOC 15-1252

SKILL.md

readonly

name	rl-report
description	SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

rl-report

Final phase of the SOC analysis pipeline. Synthesizes all prior phase outputs into two deliverables written to the working directory.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to report on:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop. At minimum, triage, FP validation, and adjudication must have completed. Tell the analyst which phases to run first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read all of the following files that exist for this investigation:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if investigation ran — not present on CONCLUSIVE FP short-circuit)
<ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if remediation ran — not present on FP verdict)

Step 2 — Spawn rl-report agent

Use the Task tool to spawn the rl-report agent. Pass:

The INVESTIGATION_ID and ARTIFACT_SLUG
The full contents of all collected phase files, clearly labeled by phase

Wait for the agent to return.

Step 3 — Report to analyst

Tell the analyst:

The final verdict and threat name (from adjudication)
IOC count
Whether investigation and remediation data was included
The paths to both output files

المزيد من هذا المستودع

نفس المستودع

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-adjudicate

reversinglabs/rl-spectra-ai-soc

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

2026-07-160

rl-fp-validate

reversinglabs/rl-spectra-ai-soc

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-remediate

reversinglabs/rl-spectra-ai-soc

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

2026-07-160

rl-report

Final phase of the SOC analysis pipeline. Synthesizes all prior phase outputs into two deliverables written to the working directory.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.

Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to report on:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop. At minimum, triage, FP validation, and adjudication must have completed. Tell the analyst which phases to run first.

One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).

Multiple files found: List them and ask the analyst which to use.

Read all of the following files that exist for this investigation:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)

<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)

<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)

<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if investigation ran — not present on CONCLUSIVE FP short-circuit)

<ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if remediation ran — not present on FP verdict)

Step 2 — Spawn rl-report agent

Use the Task tool to spawn the rl-report agent. Pass:

The INVESTIGATION_ID and ARTIFACT_SLUG

The full contents of all collected phase files, clearly labeled by phase

Wait for the agent to return.

Step 3 — Report to analyst

Tell the analyst:

The final verdict and threat name (from adjudication)

IOC count

Whether investigation and remediation data was included

The paths to both output files