Menu
Use when reading a JIRA security ticket to extract CVE IDs, affected systems, and metadata for vulnerability analysis or event investigation.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.
Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.
Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.
Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.
Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.
| name | read-ticket |
| description | Use when reading a JIRA security ticket to extract CVE IDs, affected systems, and metadata for vulnerability analysis or event investigation. |
| argument-hint | <ticket-id> |
Read a JIRA security ticket via jr CLI, extract CVE IDs and affected system metadata.
jr CLI installed and authenticated (jr auth login){PROJECT_KEY}-{NUMBER} format{PROJECT_KEY}-{NUMBER}jr issue view <ticket-id>
CVE-\d{4}-\d{4,7} from summary, description, custom fieldsjr issue assets <ticket-id>
ticket_id: '{ticket_id}'
summary: '{summary}'
description: '{description}'
cve_ids:
primary: '{primary_cve}'
all: ['{cve_1}', ...]
affected_systems: ['{system_1}', ...]
asset_criticality: '{rating}'
system_exposure: '{exposure}'
priority: '{priority}'
linked_assets: ['{asset_key}', ...]
jr auth login to authenticate with JIRA"jr issue list --jql "key = <id>"