菜单
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | ad-ldap-integration |
| description | Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi. |
| version | 0.1.0 |
The ad_ldap integration provides identity context during alert triage by querying Active Directory via LDAP. Three actions are available: a connectivity health check, a principal-based attribute lookup, and a raw LDAP filter query.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any app::ad_ldap::* action or validating response shape | Parameters, Cy return behavior, response schemas, filter cookbook, filter-value safety, error handling, known limitations |
references/investigation-patterns.md | Building identity investigation workflows or interpreting AD results | Decision matrix, field semantics, triage templates, corroboration rules, escalation/de-escalation signals |
health_check to distinguish "LDAP path broken" from "user/group does not exist."get_attributes for a quick first pass with semicolon-separated principals.run_query — prefer this for any disposition-affecting decision (sAMAccountName, group enumeration, auth-state attributes, disabled accounts).investigation-patterns.md § Auth Anomaly Triage.LDAP_MATCHING_RULE_IN_CHAIN via run_query — see investigation-patterns.md § Group Membership and Privilege Context.run_query, confirm object shape, then decide whether the alert needs auth-state, group, or service-account follow-up.badPwdCount, lastLogon, lastLogonTimestamp, lockoutTime, pwdLastSet, and userAccountControl; treat lastLogonTimestamp as coarse recency, not exact timing.primaryGroupID only if the privilege decision still matters.get_attributes is not a reliable exact-match lookup for sAMAccountName, DN, or UPN — switch to run_query before making a disposition call.lastLogon and badPwdCount are controller-local; lastLogonTimestamp is replicated but intentionally delayed. Use SIEM/EDR for exact chronology.memberOf alone is not a complete entitlement decision — it omits primary group and nested memberships.actions-reference.md § Filter-Value Safety or skip LDAP enrichment.