Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

rl-adjudicate

Estrellas0

Forks0

Actualizado16 de julio de 2026 a las 17:59

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

reversinglabs

reversinglabs/rl-spectra-ai-soc

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	rl-adjudicate
description	SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

rl-adjudicate

Fourth phase of the SOC analysis pipeline. Renders a final verdict by weighing FP validation evidence against investigation findings. Determines whether the pipeline proceeds to remediation or closes as a false positive.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to continue:

find . -maxdepth 2 -name "rl-investigate-findings-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-investigate first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read the following files (all required):

<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (for subject context)

If any required file is missing, stop and tell the analyst which phase to run first.

Step 2 — Spawn rl-adjudicate agent

Use the Task tool to spawn the rl-adjudicate agent. Pass the full contents of:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Wait for the agent to return.

Step 3 — Write rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Route based on verdict

Read the Final Verdict and Routing Decision from the output:

CONFIRMED TP or UNCERTAIN: Proceed to rl-remediate. Tell the analyst the verdict, confidence, and that the remediation playbook will be generated.
CONFIRMED FP: Tell the analyst the verdict and key audit trail signals. Skip rl-remediate and proceed directly to rl-report (or inform the orchestrator to skip remediation).

Step 5 — Report to analyst

Tell the analyst:

The final verdict and confidence level
The FP critique assessment (appropriate / too aggressive / too weak)
2–3 key signals from the audit trail that drove the decision
That <ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the routing decision

Más de este repositorio

mismo repositorio

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-fp-validate

reversinglabs/rl-spectra-ai-soc

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-remediate

reversinglabs/rl-spectra-ai-soc

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

2026-07-160

rl-report

reversinglabs/rl-spectra-ai-soc

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

2026-07-160

name	rl-adjudicate
description	SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

rl-adjudicate

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate handoff files

If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.

If invoked standalone, find the investigation to continue:

find . -maxdepth 2 -name "rl-investigate-findings-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-investigate first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which to use.

Read the following files (all required):

<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (for subject context)

If any required file is missing, stop and tell the analyst which phase to run first.

Step 2 — Spawn rl-adjudicate agent

Use the Task tool to spawn the rl-adjudicate agent. Pass the full contents of:

<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md
<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Wait for the agent to return.

Step 3 — Write rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Route based on verdict

Read the Final Verdict and Routing Decision from the output:

CONFIRMED TP or UNCERTAIN: Proceed to rl-remediate. Tell the analyst the verdict, confidence, and that the remediation playbook will be generated.
CONFIRMED FP: Tell the analyst the verdict and key audit trail signals. Skip rl-remediate and proceed directly to rl-report (or inform the orchestrator to skip remediation).

Step 5 — Report to analyst

Tell the analyst:

The final verdict and confidence level
The FP critique assessment (appropriate / too aggressive / too weak)
2–3 key signals from the audit trail that drove the decision
That <ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the routing decision