Run any Skill in Manus with one click

rl-report

Stars0

Forks0

UpdatedJuly 16, 2026 at 17:59

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

reversinglabs

reversinglabs/rl-spectra-ai-soc

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	rl-report
description	SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

rl-report

Final phase of the SOC analysis pipeline. Synthesizes all prior phase outputs into two deliverables written to the working directory.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to report on:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop. At minimum, triage, FP validation, and adjudication must have completed. Tell the analyst which phases to run first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read all of the following files that exist for this investigation:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if investigation ran — not present on CONCLUSIVE FP short-circuit)
<ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if remediation ran — not present on FP verdict)

Step 2 — Spawn rl-report agent

Use the Task tool to spawn the rl-report agent. Pass:

The INVESTIGATION_ID and ARTIFACT_SLUG
The full contents of all collected phase files, clearly labeled by phase

Wait for the agent to return.

Step 3 — Report to analyst

Tell the analyst:

The final verdict and threat name (from adjudication)
IOC count
Whether investigation and remediation data was included
The paths to both output files

More from this repository

same repository

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-adjudicate

reversinglabs/rl-spectra-ai-soc

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

2026-07-160

rl-fp-validate

reversinglabs/rl-spectra-ai-soc

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-remediate

reversinglabs/rl-spectra-ai-soc

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

2026-07-160

name	rl-report
description	SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

rl-report

Final phase of the SOC analysis pipeline. Synthesizes all prior phase outputs into two deliverables written to the working directory.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to report on:

find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r

No files found: Stop. At minimum, triage, FP validation, and adjudication must have completed. Tell the analyst which phases to run first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read all of the following files that exist for this investigation:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if investigation ran — not present on CONCLUSIVE FP short-circuit)
<ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if remediation ran — not present on FP verdict)

Step 2 — Spawn rl-report agent

Use the Task tool to spawn the rl-report agent. Pass:

The INVESTIGATION_ID and ARTIFACT_SLUG
The full contents of all collected phase files, clearly labeled by phase

Wait for the agent to return.

Step 3 — Report to analyst

Tell the analyst:

The final verdict and threat name (from adjudication)
IOC count
Whether investigation and remediation data was included
The paths to both output files