rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

Full SOC threat-analysis pipeline. Give it a file, hash, URL, IP, or domain and it runs all phases in sequence: triage → FP validation → investigation → adjudication → remediation (if TP) → reporting. Triggers on "analyze this hash", "investigate this URL", "is this malware", "run threat analysis on", "I got a suspicious file", or any submission of an indicator for end-to-end SOC workflow.

SOC triage phase. Takes a suspicious file, hash, URL, IP, or domain and produces an initial classification using ReversingLabs Spectra Intelligence. For file and hash artifacts, spawns three parallel sub-agents: classification, sandbox orchestration, and content inspection (Text/* types). For network indicators, spawns two: classification and sandbox only. Writes rl-triage-handoff.md and (if applicable) rl-triage-inspect-findings.md. Trigger when an analyst wants to triage an artifact, or as the first phase of the full rl-soc pipeline.