메뉴
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | echo-edr-integration |
| description | Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi. |
| version | 0.1.0 |
Echo EDR provides endpoint telemetry collection (processes, network connections, browser history, terminal commands) and host management actions (isolation, scanning, details). Use this skill whenever a triage workflow needs to pull endpoint data for a source IP or assess host health.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any Echo EDR action | Parameters, return schemas, Cy examples, mock-action warnings, known limitations |
references/investigation-patterns.md | Building investigation workflows | Decision trees, multi-source corroboration, Cy task templates, IP extraction, time windows |
Echo EDR exposes 8 actions split into two categories:
Data collection (live API, production-ready):
pull_processes -- process execution telemetry by endpoint IPpull_network_connections -- network connection records by endpoint IPpull_browser_history -- browser visit history by endpoint IPpull_terminal_history -- shell/command history by endpoint IPHost management (mock stubs, use with caution):
get_host_details -- returns hardcoded mock host infoisolate_host / release_host -- mock isolation togglesscan_host -- mock scan initiationpull_* actions with the IP. Add start_time/end_time (ISO 8601) to narrow results around the alert window.get_host_details -- but note it returns mock data today. Still useful for workflow scaffolding.pull_* actions on the same IP, then feed combined results to LLM. See references/investigation-patterns.md Pattern 1.isolate_host / release_host exist but are mock. Log the intent and escalate to a human operator.Review references/actions-reference.md section "Known Limitations" before using any action. Key constraints: host management actions are mock stubs; pull actions require IP (not hostname); no pagination; client-side time filtering.