菜单
Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Perform exhaustive analysis of a critical IOC. Use when an IOC needs Tier 2+ investigation beyond basic enrichment - includes GTI pivoting, deep SIEM searches, correlation with related entities, and threat attribution. For escalated IOCs requiring comprehensive investigation.
Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.
Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.
Check for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASE_ID and returns list of similar cases.
Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.
Add a comment to a case to document findings, actions, or recommendations. Use to maintain audit trail during investigations. Requires CASE_ID and comment text.
| name | close-case-artifact |
| description | Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause. |
| required_roles | {"soar":"roles/chronicle.editor"} |
| personas | ["tier1-analyst","tier2-analyst","tier3-analyst","incident-responder"] |
Close a case or alert with the required reason, root cause, and justification comment.
ARTIFACT_ID - The ID of the case or alert to closeARTIFACT_TYPE - Either "Case" or "Alert"CLOSURE_REASON - Must be one of:
MALICIOUS - Confirmed threatNOT_MALICIOUS - False positive or benignMAINTENANCE - System/maintenance activityINCONCLUSIVE - Unable to determineUNKNOWN - Unknown/otherROOT_CAUSE - Must match a predefined root cause (use get_case_settings_root_causes to list options)CLOSURE_COMMENT - Detailed justification for closureALERT_GROUP_IDENTIFIERS - Alert group identifiersASSIGN_TO_USER - User to assign closed alert toTAGS - Comma-separated tagsFor Cases:
secops-soar.siemplify_close_case(
case_id=ARTIFACT_ID,
reason=CLOSURE_REASON,
root_cause=ROOT_CAUSE,
comment=CLOSURE_COMMENT,
alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)
For Alerts:
secops-soar.siemplify_close_alert(
alert_id=ARTIFACT_ID,
reason=CLOSURE_REASON,
root_cause=ROOT_CAUSE,
comment=CLOSURE_COMMENT,
assign_to_user=ASSIGN_TO_USER,
tags=TAGS
)
| Output | Description |
|---|---|
CLOSURE_STATUS | Success/failure status of the closure |
| Scenario | Reason | Typical Root Cause |
|---|---|---|
| False Positive | NOT_MALICIOUS | "Legit action", "Normal behavior" |
| Duplicate | NOT_MALICIOUS | "Similar case is already under investigation" |
| Benign True Positive | NOT_MALICIOUS | "Legit action" |
| Confirmed Threat (remediated) | MALICIOUS | Varies by threat type |
| Unable to determine | INCONCLUSIVE | "Insufficient data" |
If unsure of valid root cause values:
secops-soar.get_case_settings_root_causes()