メニュー
Reverse /secops-factory:activate — remove the orchestrator default-agent override and the activation metadata from .claude/settings.local.json. Leaves the plugin enabled; only the default persona is cleared.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.
Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.
Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.
Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.
Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.
| name | deactivate |
| description | Reverse /secops-factory:activate — remove the orchestrator default-agent override and the activation metadata from .claude/settings.local.json. Leaves the plugin enabled; only the default persona is cleared. |
| disable-model-invocation | true |
Reverses everything /secops-factory:activate does: clears the orchestrator default-agent override in .claude/settings.local.json and removes the secops-factory activation block. The plugin itself stays enabled — agents, skills, hooks, and commands remain available for explicit invocation or future re-activation.
Before any other action, say verbatim:
I am using the deactivate skill to remove the SecOps Factory orchestrator as this project's default agent.
Read .claude/settings.local.json. If it doesn't exist, the factory was never activated here — say so and stop.
Sanity-check the agent default. If the existing agent value does not point at a secops-factory: agent, stop and warn — don't clobber unrelated config (another plugin may own the default).
Remove the keys. Use jq 'del(.agent) | del(.["secops-factory"])' and write the file back. If the resulting object is empty, either delete the file or leave it as {} — ask the user which.
Confirm. Print:
settings.local.json contents/secops-factory:activate is the inverse| Thought | Reality |
|---|---|
| "The agent key points at vsdd-factory, I'll remove it anyway" | Stop and warn. Only remove a secops-factory: default — never another plugin's. |
| "I'll delete the whole settings file to be thorough" | Other keys (permissions, env) may live there. Delete only the two activation keys. |
| "Deactivating means uninstalling the plugin" | No — the plugin stays enabled. Only the default persona is cleared. |
| "The file doesn't exist, I'll create an empty one" | Nothing to do. Report that the factory was never activated and stop. |
| "I'll skip the read-back verification" | Verify with jq after writing. A malformed settings file breaks the whole session. |
| "The user probably wants the hooks disabled too" | Hooks belong to plugin enablement, not activation. Leave them alone. |
/secops-factory:activate — the inverse