Run any Skill in Manus with one click

rl-remediate

Stars0

Forks0

UpdatedJuly 16, 2026 at 17:59

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

reversinglabs

reversinglabs/rl-spectra-ai-soc

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	rl-remediate
description	SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

rl-remediate

Fifth phase of the SOC analysis pipeline (conditional). Produces a prioritized containment and eradication playbook based on all prior phase findings.

This phase only runs if the adjudication verdict is CONFIRMED TP or UNCERTAIN. If the verdict is CONFIRMED FP, skip this phase.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to continue:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-adjudicate first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read the following files:

<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (for IOCs and context)

Check the adjudication verdict. If it is CONFIRMED FP, stop and tell the analyst:

Adjudication verdict is CONFIRMED FP — remediation is not required. Proceeding to reporting.

Step 2 — Spawn rl-remediate agent

Use the Task tool to spawn the rl-remediate agent. Pass the full contents of:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Wait for the agent to return.

Step 3 — Write rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Report to analyst

Tell the analyst:

Containment action count (P0 / P1 / P2 breakdown)
Eradication action count
That <ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step: run rl-report

More from this repository

same repository

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-adjudicate

reversinglabs/rl-spectra-ai-soc

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

2026-07-160

rl-fp-validate

reversinglabs/rl-spectra-ai-soc

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-report

reversinglabs/rl-spectra-ai-soc

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

2026-07-160

name	rl-remediate
description	SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

rl-remediate

Fifth phase of the SOC analysis pipeline (conditional). Produces a prioritized containment and eradication playbook based on all prior phase findings.

This phase only runs if the adjudication verdict is CONFIRMED TP or UNCERTAIN. If the verdict is CONFIRMED FP, skip this phase.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to continue:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-adjudicate first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read the following files:

<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (for IOCs and context)

Check the adjudication verdict. If it is CONFIRMED FP, stop and tell the analyst:

Adjudication verdict is CONFIRMED FP — remediation is not required. Proceeding to reporting.

Step 2 — Spawn rl-remediate agent

Use the Task tool to spawn the rl-remediate agent. Pass the full contents of:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Wait for the agent to return.

Step 3 — Write rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Report to analyst

Tell the analyst:

Containment action count (P0 / P1 / P2 breakdown)
Eradication action count
That <ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step: run rl-report