Run any Skill in Manus with one click

rl-fp-validate

Stars0

Forks0

UpdatedJuly 16, 2026 at 17:59

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

reversinglabs

reversinglabs/rl-spectra-ai-soc

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	rl-fp-validate
description	False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

rl-fp-validate

Second phase of the SOC analysis pipeline. Evaluates FP signals from triage data and determines whether the pipeline should continue to investigation or short-circuit as a false positive.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate triage handoff

If invoked by the rl-soc orchestrator, the investigation ID and triage handoff contents are provided directly — skip file discovery.

If invoked standalone, find the triage handoff file:

find . -maxdepth 2 -name "rl-triage-handoff-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-triage first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which investigation to continue (show the artifact slug, ID, and modification time for each).

Read the chosen <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 2 — Spawn rl-fp-validate agent

Use the Task tool to spawn the rl-fp-validate agent. Pass the full contents of <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md as its input.

Wait for the agent to return.

Step 3 — Write rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Check for short-circuit

Read the Recommendation field from the findings:

CONCLUSIVE FP: Tell the analyst the finding is a false positive and explain the key signals. Tell them the pipeline will skip investigation, adjudication, and remediation. Proceed directly to rl-report (or inform the rl-soc orchestrator to short-circuit).
POSSIBLE FP / LIKELY TP / INSUFFICIENT DATA: Tell the analyst the FP confidence level and key signals. Proceed to rl-investigate (or inform the orchestrator to continue normally).

Step 5 — Report to analyst

Tell the analyst:

The FP recommendation and overall FP confidence
The top 2–3 signals driving the assessment
That <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the recommendation

More from this repository

same repository

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-adjudicate

reversinglabs/rl-spectra-ai-soc

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-remediate

reversinglabs/rl-spectra-ai-soc

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

2026-07-160

rl-report

reversinglabs/rl-spectra-ai-soc

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

2026-07-160

name	rl-fp-validate
description	False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

rl-fp-validate

Second phase of the SOC analysis pipeline. Evaluates FP signals from triage data and determines whether the pipeline should continue to investigation or short-circuit as a false positive.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate triage handoff

If invoked by the rl-soc orchestrator, the investigation ID and triage handoff contents are provided directly — skip file discovery.

If invoked standalone, find the triage handoff file:

find . -maxdepth 2 -name "rl-triage-handoff-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-triage first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which investigation to continue (show the artifact slug, ID, and modification time for each).

Read the chosen <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 2 — Spawn rl-fp-validate agent

Use the Task tool to spawn the rl-fp-validate agent. Pass the full contents of <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md as its input.

Wait for the agent to return.

Step 3 — Write rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Check for short-circuit

Read the Recommendation field from the findings:

CONCLUSIVE FP: Tell the analyst the finding is a false positive and explain the key signals. Tell them the pipeline will skip investigation, adjudication, and remediation. Proceed directly to rl-report (or inform the rl-soc orchestrator to short-circuit).
POSSIBLE FP / LIKELY TP / INSUFFICIENT DATA: Tell the analyst the FP confidence level and key signals. Proceed to rl-investigate (or inform the orchestrator to continue normally).

Step 5 — Report to analyst

Tell the analyst:

The FP recommendation and overall FP confidence
The top 2–3 signals driving the assessment
That <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the recommendation