메뉴
Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | unshortenme-integration |
| description | Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy. |
| version | 0.1.0 |
Expand shortened URLs to reveal final destinations during phishing triage. Authentication is managed at the Analysi integration connection level (API token configured once, transparent to Cy scripts). Rate-limited to 10 calls/hour for new URLs (previously-resolved URLs are cached and unlimited). Pre-filter to known shortener domains to conserve quota — see actions-reference.md § Rate Limit Management for the canonical domain list.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any unshortenme action | Parameters, return schemas, Cy call snippets, error types, rate limit rules, shortener domain list |
references/investigation-patterns.md | Building phishing triage workflows | Decision trees, multi-source corroboration, complete Cy task templates, TP/FP signal tables |
actions-reference.md § Rate Limit Management)app::unshortenme::unshorten_url(url=short_url) with try/catchresolved_url into downstream enrichment (Global DNS, WHOIS RDAP)try {
result = app::unshortenme::unshorten_url(url=url)
resolved = result.resolved_url ?? url
} catch (e) { resolved = url }
For complete task templates with LLM analysis and enrichment, see investigation-patterns.md.
remaining_calls in responses (see actions-reference.md § Rate Limit Management)resolved_url is the final destination