菜单
Use when researching a CVE for vulnerability intelligence. Queries Perplexity for CVSS, EPSS, KEV, exploit status, patches, ATT&CK mapping, and technical details from authoritative sources.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.
Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.
Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.
Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.
Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.
| name | research-cve |
| description | Use when researching a CVE for vulnerability intelligence. Queries Perplexity for CVSS, EPSS, KEV, exploit status, patches, ATT&CK mapping, and technical details from authoritative sources. |
| argument-hint | <cve-id> |
Deep CVE research using AI-assisted intelligence gathering. Uses Perplexity MCP when available; falls back to web search and manual research guidance when it is not.
Before starting research, check if Perplexity MCP is available. If any mcp__perplexity__* tool is accessible, use the Perplexity path. If not:
WebSearch or WebFetch tools to query NVD, CISA KEV, and FIRST EPSS directly:
https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=<CVE-ID>https://api.first.org/data/v1/epss?cve=<CVE-ID>https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.jsonsource: manual-web-search instead of source: perplexityThe quality rubric does not penalize manual research. It penalizes missing data regardless of collection method.
Format: CVE-\d{4}-\d{4,7} (case-insensitive). Reject invalid formats. Max 3 retries.
Query Perplexity for comprehensive intelligence:
| CVSS Score | Tool | Rationale |
|---|---|---|
| 9.0-10.0 | mcp__perplexity__perplexity_research | Deep 2-5 min analysis |
| 7.0-8.9 | mcp__perplexity__perplexity_reason | Moderate 30-60s analysis |
| 0.1-6.9 | mcp__perplexity__perplexity_search | Quick 10-20s lookup |
| Unknown | mcp__perplexity__perplexity_reason | Default moderate |
Trusted: NVD, CISA, FIRST, MITRE, vendor security sites, GitHub advisories Flag as unverified: Blogs, news sites, social media, forums
Priority hierarchy: NVD > Vendor > Third-party for CVSS. Vendor > NVD for patches. CISA > vendors for exploitation status.
Return YAML with: cvss, epss, kev, affected_products, patches, exploit_status, attack_mapping, description, sources, warnings.