secops-factory

Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).

Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.

Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.

Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.

Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.

Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.

Reverse /secops-factory:activate — remove the orchestrator default-agent override and the activation metadata from .claude/settings.local.json. Leaves the plugin enabled; only the default persona is cleared.

Use when creating a structured security advisory for a CVE, threat campaign, or vendor bulletin. Supports IT, ICS/OT, and combined audiences. Accepts built-in or custom templates.

Use when enriching a security ticket with vulnerability intelligence. Executes 8-stage enrichment: triage, CVE research, business context, remediation, ATT&CK mapping, priority assessment, documentation, JIRA update.

Use when verifying factual claims in security analyses against authoritative sources. Supports CVE claim verification and event investigation verification.

Use when investigating a security event alert (ICS, IDS, SIEM). Executes 7-stage investigation: triage, metadata, network IDs, evidence, analysis, disposition (TP/FP/BTP), documentation and JIRA update.

Use when scanning for emerging security threats, recent CVE disclosures, CISA alerts, vendor advisories, and ICS-CERT bulletins. Filters by sector, severity, and advisory worthiness.

Use when reading a JIRA security ticket to extract CVE IDs, affected systems, and metadata for vulnerability analysis or event investigation.

Use when updating JIRA security ticket custom fields with enrichment data. Validates data, maps to configured field IDs, and updates via jr CLI.

Use when researching a CVE for vulnerability intelligence. Queries Perplexity for CVSS, EPSS, KEV, exploit status, patches, ATT&CK mapping, and technical details from authoritative sources.

Use when performing multi-pass adversarial convergence review of security analyses. Dispatches security-reviewer in fresh-context passes with strict-binary novelty until convergence. Quality thresholds: >=7.0/10 overall, no dimension <5.0.

Use when reviewing a security analyst's enrichment or investigation. Polymorphic: auto-detects CVE enrichment (8-dimension scoring) or event investigation (7-dimension weighted scoring). Blameless, constructive feedback.

Use when calculating multi-factor vulnerability priority. Combines CVSS severity, EPSS exploitation probability, CISA KEV status, asset criticality, system exposure, and exploit availability into P1-P5 with SLA.

Use when mapping a CVE to MITRE ATT&CK framework tactics and techniques. Supports both Enterprise and ICS ATT&CK matrices.