メニュー
Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | unshortenme-integration |
| description | Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy. |
| version | 0.1.0 |
Expand shortened URLs to reveal final destinations during phishing triage. Authentication is managed at the Analysi integration connection level (API token configured once, transparent to Cy scripts). Rate-limited to 10 calls/hour for new URLs (previously-resolved URLs are cached and unlimited). Pre-filter to known shortener domains to conserve quota — see actions-reference.md § Rate Limit Management for the canonical domain list.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any unshortenme action | Parameters, return schemas, Cy call snippets, error types, rate limit rules, shortener domain list |
references/investigation-patterns.md | Building phishing triage workflows | Decision trees, multi-source corroboration, complete Cy task templates, TP/FP signal tables |
actions-reference.md § Rate Limit Management)app::unshortenme::unshorten_url(url=short_url) with try/catchresolved_url into downstream enrichment (Global DNS, WHOIS RDAP)try {
result = app::unshortenme::unshorten_url(url=url)
resolved = result.resolved_url ?? url
} catch (e) { resolved = url }
For complete task templates with LLM analysis and enrichment, see investigation-patterns.md.
remaining_calls in responses (see actions-reference.md § Rate Limit Management)resolved_url is the final destination