菜单
WHOIS RDAP lookups for IP ownership, ASN, and netblock attribution during SOC investigations. Use when triaging alerts involving external IPs to identify registrant organizations, autonomous systems, hosting context, or abuse contacts via RDAP query.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | whois-rdap-integration |
| description | WHOIS RDAP lookups for IP ownership, ASN, and netblock attribution during SOC investigations. Use when triaging alerts involving external IPs to identify registrant organizations, autonomous systems, hosting context, or abuse contacts via RDAP query. |
| version | 0.1.0 |
Free, unauthenticated IP registration lookups via RDAP protocol. Returns ASN, netblock CIDR, registrant organization, country, and abuse contacts for any public IPv4 or IPv6 address. No API key required.
| Reference | Read when | Consult for |
|---|---|---|
actions-reference.md | Calling any WHOIS RDAP action | Parameters, return field schemas, Cy examples, edge case behavior, standard IP extraction pattern |
investigation-patterns.md | Building triage workflows | IP attribution decision trees, multi-source corroboration, Cy task templates, field interpretation |
app::whois_rdap::whois_ip(ip=target_ip) — see actions-reference.md § Cy Usage for the standard call-and-extract patterninvestigation-patterns.mdapp::whois_rdap::health_check() — returns healthy: true/false in ~1 secondlist_integrations(configured_only=True) via MCPnull (not an error) — see actions-reference.md § Edge Cases for the full behavior table and handling pattern.