Renders the final incident-commander brief: executive summary, technical narrative, kill-chain stanzas (intrusion → persistence → execution → lateral → exfil), remediation ledger, and open-risk assessment. Use when the case is closing and the operator needs a structured human-readable handoff document.
Executes case lifecycle state transitions (open / hold / reopen / close), maintains the INDEX row, and emits agentic-minutes status blocks with next-step + blocking-question. Use when the case needs lifecycle adjudication, status reporting, or close-criteria evaluation.
Extracts, deduplicates, and clusters IPs (with /24 grouping and CDN-safelist awareness), domains (punycode-decoded, subdomain-flattened), file hashes (MD5/SHA256), URL patterns, and webshell fingerprint families from raw evidence. Use when the case needs IOC normalization or aggregation for downstream rule scoping or attribution.
Adjudicates ModSec deny-events, APF blocks, YARA/LMD signature hits, or anomaly flags as genuine threat or benign-pattern match. Records suppression rationale. Use when the case has a candidate alert that needs FP/TP classification before downstream rule authoring or escalation.
Authors ModSec rules, APF/CSF/iptables/nftables firewall blocks, and LMD/ClamAV signature submissions for confirmed attack patterns. Validates with apachectl preflight, FP-corpus checks, and CDN-safelist awareness. Use when the case requires generating a defensive rule, signature, or block to prevent recurrence.
Correlates forensic evidence across log streams (apache.access, apache.error, modsec.audit, journald, fs mtime clusters, cron events) to build attribution-grounded hypotheses with cross-stream citations. Use when the case needs evidence consolidation across multiple sources, hypothesis grounding, or kill-chain reconstruction.