菜单
Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | unshortenme-integration |
| description | Expand shortened URLs via unshorten.me during phishing triage and URL-based alert investigations. Use when investigating suspicious links, bit.ly/tinyurl/t.co URLs in alerts, or building URL expansion workflows in Cy. |
| version | 0.1.0 |
Expand shortened URLs to reveal final destinations during phishing triage. Authentication is managed at the Analysi integration connection level (API token configured once, transparent to Cy scripts). Rate-limited to 10 calls/hour for new URLs (previously-resolved URLs are cached and unlimited). Pre-filter to known shortener domains to conserve quota — see actions-reference.md § Rate Limit Management for the canonical domain list.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any unshortenme action | Parameters, return schemas, Cy call snippets, error types, rate limit rules, shortener domain list |
references/investigation-patterns.md | Building phishing triage workflows | Decision trees, multi-source corroboration, complete Cy task templates, TP/FP signal tables |
actions-reference.md § Rate Limit Management)app::unshortenme::unshorten_url(url=short_url) with try/catchresolved_url into downstream enrichment (Global DNS, WHOIS RDAP)try {
result = app::unshortenme::unshorten_url(url=url)
resolved = result.resolved_url ?? url
} catch (e) { resolved = url }
For complete task templates with LLM analysis and enrichment, see investigation-patterns.md.
remaining_calls in responses (see actions-reference.md § Rate Limit Management)resolved_url is the final destination