菜单
Parse, validate, and map OCSF Detection Finding events. Use when normalizing security alerts to OCSF, building detection-as-code pipelines, mapping vendor alerts to MITRE ATT&CK, extracting observables, or working with finding_info structures and severity/status enums.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | ocsf-detection-finding |
| version | 0.1.0 |
| description | Parse, validate, and map OCSF Detection Finding events. Use when normalizing security alerts to OCSF, building detection-as-code pipelines, mapping vendor alerts to MITRE ATT&CK, extracting observables, or working with finding_info structures and severity/status enums. |
Detection Finding events represent alerts from security products — correlation engines, EDR, SIEM rules, ML models, or cloud-native detectors. Class UID is always 2004, category is Findings (category_uid: 2). The type_uid is derived as class_uid × 100 + activity_id (e.g., 200401 for Create).
Apply the security_control profile when the producer is a security control. Use the incident profile when findings feed into incident workflows.
| Reference | Read when | Consult for |
|---|---|---|
references/attributes.md | Building or validating a Detection Finding event | All top-level attributes, requirement levels, type_uid calculation, severity/status/confidence/impact/risk enums, activity enum |
references/finding-info.md | Working with detection rule metadata or finding details | finding_info fields, Analytic object (type_id, state_id enums), related_analytics, related_events |
references/attack-mappings.md | Mapping to MITRE ATT&CK or Cyber Kill Chain | Attack object structure, tactic/technique/sub_technique constraints, common tactic IDs, kill_chain phase_id values |
references/metadata-profiles.md | Setting product info, log source, or applying profiles | Metadata object, Product object, profile list, Security Control / Cloud profile attributes |
references/observables-evidence.md | Extracting IOCs or examining triggering evidence | Observable type_id enum (0–48), Reputation object, Evidence Artifacts fields, verdict_id enum |
references/examples.md | Constructing or reviewing Detection Finding JSON | Minimal event, full EDR alert, cloud detection, Update/Close events, vendor mapping patterns, validation checklist |
attributes.md for required fields, then examples.md for templatesexamples.md for target shape, consult attributes.md for enums, finding-info.md for analytic type mapping, observables-evidence.md for IOC extractionattributes.md, verify type_uid = class_uid × 100 + activity_id, validate finding_info via finding-info.mdattack-mappings.md for the nested attack object structure and common tactic IDsobservables-evidence.md for IOC type codes and evidence artifact interpretationtype_uid must equal class_uid × 100 + activity_id (e.g., 200401 for Create)finding_info.uid is the only required field inside finding_info; at least one of analytic.name or analytic.uid must be present when analytic is includedtechnique, tactic, or sub_techniquetactics (plural array) is deprecated since v1.1.0 — use singular tactic object