用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/dandye/adk_runbooks --skill check-duplicate-cases命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.
Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.
Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.
正在显示 SKILL.md
| name | check-duplicate-cases |
| description | Use when checking SOAR cases for overlapping entities to detect duplicate incidents. |
| category | common |
| version | 1.0.0 |
| type | Skill |
| title | Skill: Common Step: Check for Duplicate/Similar SOAR Cases |
| generated | {"by":"human:dandye","at":"2025-11-10T22:21:35.000Z"} |
Identify potentially duplicate or similar existing SOAR cases based on the context of a current case or alert.
This sub-runbook executes the siemplify_get_similar_cases action in the SOAR platform using specified criteria. It returns a list of potential duplicate/similar case IDs.
${CASE_ID}: The ID of the current case to check against.${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers for the current case.${SIMILARITY_CRITERIA}: A structure or set of flags indicating the criteria for similarity search (e.g., Rule Generator, Port, Entity Identifier - specific to the siemplify_get_similar_cases tool). Defaults might be defined here or passed by the caller.${DAYS_BACK}: How many days back to search for similar cases (default could be 7 or passed by caller).${INCLUDE_OPEN}: Boolean, whether to include open cases (default: true).${INCLUDE_CLOSED}: Boolean, whether to include closed cases (default: false).${SIMILAR_CASE_IDS}: A list of case IDs identified as potentially similar or duplicate.${SIMILARITY_CHECK_STATUS}: Confirmation or status of the check attempt.secops-soar: siemplify_get_similar_cases${CASE_ID}, ${ALERT_GROUP_IDENTIFIERS}, and optional criteria (${SIMILARITY_CRITERIA}, ${DAYS_BACK}, etc.) from the calling runbook.soar-mcp_siemplify_get_similar_cases with the provided inputs. Use defaults if optional inputs are not provided.${SIMILAR_CASE_IDS} and the status of the check in ${SIMILARITY_CHECK_STATUS}. Return these to the calling runbook.sequenceDiagram
participant CallingRunbook
participant CheckDuplicates as check_duplicate_cases.md (This Runbook)
participant SOAR as secops-soar
CallingRunbook->>CheckDuplicates: Execute Duplicate Check\nInput: CASE_ID, ALERT_GROUP_IDS, CRITERIA (opt), DAYS_BACK (opt)...
%% Step 2: Check Similar Cases
Note over CheckDuplicates: Prepare arguments for siemplify_get_similar_cases
CheckDuplicates->>SOAR: siemplify_get_similar_cases(case_id=CASE_ID, alert_group_identifiers=ALERT_GROUP_IDS, ...)
SOAR-->>CheckDuplicates: Similar Case List (SIMILAR_CASE_IDS), Status (SIMILARITY_CHECK_STATUS)
%% Step 3: Return Results
CheckDuplicates-->>CallingRunbook: Return Results:\nSIMILAR_CASE_IDS,\nSIMILARITY_CHECK_STATUS
The siemplify_get_similar_cases action has been attempted. The list of potential similar case IDs (${SIMILAR_CASE_IDS}) and the status (${SIMILARITY_CHECK_STATUS}) are available.