What this organisation is, which email is expected, and who works here. Load it before you judge a sender, a sign-in, or an account change. This file is a template. Replace the example rows before you publish it.
Load before the first read of any phishing or suspicious email investigation, whether you are triaging a Sublime message group or answering a question about an email in chat. Operating rules for email evidence: which Sublime and Google Workspace reads are…
Load when the prompt is a raw Slack payload, either an Events API envelope or an Interactivity payload. Covers how Socky handles an app_mention (acknowledge, read the thread from Slack, answer, record on the case, mark done) and the owner's Yes/No buttons on…
Load when the prompt's first line is `Sublime detection proposal <canonical_id>`. Turns one confirmed malicious email into a tested Sublime MQL detection rule proposal: read what made the message malicious, check what already catches it, author MQL, validate…
Load when the prompt's first line is `Phishing message <canonical_id>`, followed by one Sublime message group as JSON. Takes one flagged or user-reported email from Sublime to a triaged case and a published Slack card. You read the group, pull its indicators…
Prose rules for case comments, incident summaries, Slack briefs and any analyst facing text, built on ASD-STE100 Simplified Technical English. Covers sentence construction, word choice, and the evidential qualifiers a security case must keep. Attach to any…
Load when the prompt's first line is `OAuth app lifecycle <primary_user>|<client_id>`, followed by one app's grant data as JSON. Takes one Google Workspace OAuth app from the audit log to a triaged Tracecat case and a published Slack card. You read the saved…
Load when the prompt's first line is `OAuth grant review <grant_key>`, and whenever a lifecycle skill or a request asks you to judge one Google Workspace OAuth app grant. Assess how much access that grant gives one person, and produce the severity, the…