菜单
VirusTotal threat intelligence lookups for SOC alert triage via Analysi. Use when checking IP, domain, URL, or file hash reputation, investigating malware indicators, correlating threat data across detection engines, or enriching alerts with crowd-sourced detection results.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | virustotal-integration |
| description | VirusTotal threat intelligence lookups for SOC alert triage via Analysi. Use when checking IP, domain, URL, or file hash reputation, investigating malware indicators, correlating threat data across detection engines, or enriching alerts with crowd-sourced detection results. |
| version | 0.1.0 |
Query VirusTotal's crowd-sourced threat intelligence database from Cy scripts to enrich alerts with IP, domain, URL, and file hash reputation data. The integration (app::virustotal::) provides 6 actions covering reputation lookups and on-demand URL analysis.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any VT action in Cy | Parameters, return schemas, response field meanings, detection thresholds, known limitations |
references/investigation-patterns.md | Building investigation workflows | Decision trees, Cy task templates with LLM reasoning, multi-source corroboration, batch IOC analysis |
app::virustotal::ip_reputation(ip=ip) — detection stats + ASN/countryapp::virustotal::domain_reputation(domain=domain) — detection stats + categoriesapp::virustotal::url_reputation(url=url) — detection stats + submission historyapp::virustotal::file_reputation(file_hash=hash) — detection stats + file metadatasubmit_url_analysis(url=url) then get_analysis_report(analysis_id=id) — two-step submit-then-pollAll four reputation actions return a reputation_summary with fields malicious, suspicious, harmless, undetected (integer counts of engines). See actions-reference.md § Common Response Patterns for full schema and interpretation thresholds.
submit_url_analysis + get_analysis_report is a two-step async pattern — check analysis_status == "completed" before trusting statsnot_found flag appears when VT has no data — see actions-reference.md § The not_found Flag