Cut a stable GitHub release or prerelease directly from a Tracecat release branch, including the version bump, tag, image verification, and categorized release notes.
What this organisation is, which email is expected, and who works here. Load it before you judge a sender, a sign-in, or an account change. This file is a template. Replace the example rows before you publish it.
Load before the first read of any phishing or suspicious email investigation, whether you are triaging a Sublime message group or answering a question about an email in chat. Operating rules for email evidence: which Sublime and Google Workspace reads are…
Load when the prompt is a raw Slack payload, either an Events API envelope or an Interactivity payload. Covers how Socky handles an app_mention (acknowledge, read the thread from Slack, answer, record on the case, mark done) and the owner's Yes/No buttons on…
Load when the prompt's first line is `Sublime detection proposal <canonical_id>`. Turns one confirmed malicious email into a tested Sublime MQL detection rule proposal: read what made the message malicious, check what already catches it, author MQL, validate…
Load when the prompt's first line is `Phishing message <canonical_id>`, followed by one Sublime message group as JSON. Takes one flagged or user-reported email from Sublime to a triaged case and a published Slack card. You read the group, pull its indicators…
Prose rules for case comments, incident summaries, Slack briefs and any analyst facing text, built on ASD-STE100 Simplified Technical English. Covers sentence construction, word choice, and the evidential qualifiers a security case must keep. Attach to any…
Load when the prompt's first line is `OAuth app lifecycle <primary_user>|<client_id>`, followed by one app's grant data as JSON. Takes one Google Workspace OAuth app from the audit log to a triaged Tracecat case and a published Slack card. You read the saved…