메뉴
Post-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went wrong
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
SOC 직업 분류 기준
| name | thrunt-forensics |
| description | Post-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went wrong |
| argument-hint | [problem description] |
| allowed-tools | Read, Write, Bash, Grep, Glob |
Purpose: Diagnose failed or stuck workflows so the user can understand root cause and take corrective action.
Output: Forensic report saved to .planning/forensics/, presented inline, with optional issue creation.
<execution_context> @.github/thrunt-god/workflows/forensics.md </execution_context>
**Data sources:** - `git log` (recent commits, patterns, time gaps) - `git status` / `git diff` (uncommitted work, conflicts) - `.planning/STATE.md` (current position, session history) - `.planning/HUNTMAP.md` (phase scope and progress) - `.planning/phases/*/` (PLAN.md, SUMMARY.md, FINDINGS.md, CONTEXT.md) - `.planning/reports/SESSION_REPORT.md` (last session outcomes)User input:
<success_criteria>
.planning/forensics/report-{timestamp}.md<critical_rules>