dandye

Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.

Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.

Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.

Use when initiating threat hunting operations driven by GTI threat campaign intelligence.

Use when conducting initial reputation and threat intelligence lookups on suspicious observables.

Use when performing exhaustive forensic and intelligence analysis on complex indicators of compromise.

Use when enriching and verifying case artifacts with external threat intelligence platforms.

Use when executing network, host, or credential containment actions for validated malicious IOCs.

Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.

Identify content gaps and organizational opportunities. Analyzes missing content areas, redundancies, and consolidation opportunities.

Comprehensive content quality and maintenance assessment. Evaluates documentation quality, relevance, maintenance needs, and provides actionable recommendations.

Check for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASE_ID and returns list of similar cases.

Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.

Automated content similarity and grouping analysis. Groups related documents by topic, purpose, or content similarity.

Ask the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response.

Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.

Normalize named entities and concept variants into canonical forms using controlled vocabularies or standard taxonomies.

Analyze vocabulary overlap and identify named entities unique to domain/document corpora.

Transform lengthy documents into a semantic tree structure. It extracts sections, summaries, and hierarchies optimized for use with Large Language Models (LLMs).

Design formal ontologies using OWL/RDFS. Defines classes, properties, and relationships for complex semantic modeling.

Systematic cataloging of information assets. Creates comprehensive inventories or card sorting materials from content.

Generate JSON-LD structured data for web content. Maps content to Schema.org types to improve search engine understanding and rich result eligibility.

Analyze multiple documents to extract entities and relationships, generating a knowledge graph structure (RDF/Turtle).

Map local tags, categories, or terms to standard formal ontologies (like SKOS or industry-specific standards) to ensure interoperability.

Helps the user configure the Google SecOps Remote MCP Server for Antigravity. Use this when the user asks to "set up" or "configure" the security tools for Antigravity.

List recent SOAR cases. Use this for "list cases" or "show cases".

Expert guidance for proactive threat hunting. Use this when the user asks to "hunt" for threads, IOCs, or specific TTPs.

Expert guidance for deep security investigations. Use this when the user asks to "investigate" a case, entity, or incident.

Expert guidance for security alert triage. Use this when the user asks to "triage" an alert or case.

Expert guidance for proactive threat hunting. Use this when the user asks to "hunt" for threads, IOCs, or specific TTPs.

Expert guidance for deep security investigations. Use this when the user asks to "investigate" a case, entity, or incident.

Analyzes security events and drafts target rules.

Expert guidance for security alert triage. Use this when the user asks to "triage" an alert or case.

Enables the agent to communicate with human security analysts for notifications and high-stakes confirmations (Human-in-the-loop).

A foundational skill for extracting, contextualizing, and evaluating an Indicator of Compromise (IOC) against internal and external threat intelligence.

A comprehensive skill that provides logic, instructions, and workflows for properly identifying, analyzing, and containing malware samples discovered in the environment.

Guide technical documentation creation and editing according to ASD-STE100 Simplified Technical English (STE). Enforces controlled vocabulary, strict grammar constraints (active voice, max 20-word instructions, simple tenses), and extensible project-specific…

Audit technical documentation for compliance with ASD-STE100 Simplified Technical English (STE) rules. Evaluates sentence length limits, passive voice, complex verb tenses, noun stacks (>3), unapproved vocabulary, and missing warning placements. Produces a…

Automatically generate a project-specific Extensible STE Dictionary (.ste-dictionary.yaml) from a codebase or document set. Cross-references the `information-architecture` skill suite (`vocabulary-overlap-analysis`, `thesaurus-generate`,…

Create a session handoff and resumption checkpoint before you clear chat history or start a new session. Inspect workspace state, write HANDOFF.md, and create a prompt to start the next session. Use when: - You want to run /clear or start a new session. - You…

Popperian falsification method (after Karl Popper) that turns a vague problem, symptom, or mystery into 2-4 competing falsifiable theories, then asks ranked discriminating questions whose answers kill the weakest theories fastest. Never seeks confirmation —…