一键在 Manus 中运行任何 Skill

rl-fp-validate

星标0

分支0

更新时间2026年7月16日 17:59

False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

reversinglabs

reversinglabs/rl-spectra-ai-soc

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

rl-fp-validate

Second phase of the SOC analysis pipeline. Evaluates FP signals from triage data and determines whether the pipeline should continue to investigation or short-circuit as a false positive.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate triage handoff

If invoked by the rl-soc orchestrator, the investigation ID and triage handoff contents are provided directly — skip file discovery.

If invoked standalone, find the triage handoff file:

find . -maxdepth 2 -name "rl-triage-handoff-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-triage first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which investigation to continue (show the artifact slug, ID, and modification time for each).

Read the chosen <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 2 — Spawn rl-fp-validate agent

Use the Task tool to spawn the rl-fp-validate agent. Pass the full contents of <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md as its input.

Wait for the agent to return.

Step 3 — Write rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Check for short-circuit

Read the Recommendation field from the findings:

CONCLUSIVE FP: Tell the analyst the finding is a false positive and explain the key signals. Tell them the pipeline will skip investigation, adjudication, and remediation. Proceed directly to rl-report (or inform the rl-soc orchestrator to short-circuit).
POSSIBLE FP / LIKELY TP / INSUFFICIENT DATA: Tell the analyst the FP confidence level and key signals. Proceed to rl-investigate (or inform the orchestrator to continue normally).

Step 5 — Report to analyst

Tell the analyst:

The FP recommendation and overall FP confidence
The top 2–3 signals driving the assessment
That <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the recommendation

同仓库更多 Skills

同仓库

rl-soc-connect

reversinglabs/rl-spectra-ai-soc

Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.

2026-07-160

rl-soc-install

reversinglabs/rl-spectra-ai-soc

Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.

2026-07-160

rl-adjudicate

reversinglabs/rl-spectra-ai-soc

SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.

2026-07-160

rl-investigate

reversinglabs/rl-spectra-ai-soc

SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.

2026-07-160

rl-remediate

reversinglabs/rl-spectra-ai-soc

SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.

2026-07-160

rl-report

reversinglabs/rl-spectra-ai-soc

SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

2026-07-160

name	rl-fp-validate
description	False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.

rl-fp-validate

Second phase of the SOC analysis pipeline. Evaluates FP signals from triage data and determines whether the pipeline should continue to investigation or short-circuit as a false positive.

CRITICAL CONSTRAINTS

Do NOT use any rl-protect skills or tools.
Do NOT check for credentials, .env files, or venv paths.

Step 1 — Locate triage handoff

If invoked by the rl-soc orchestrator, the investigation ID and triage handoff contents are provided directly — skip file discovery.

If invoked standalone, find the triage handoff file:

find . -maxdepth 2 -name "rl-triage-handoff-*.md" 2>/dev/null | sort -r

No files found: Stop and tell the analyst to run rl-triage first.
One file found: Use it. ARTIFACT_SLUG is the name of the parent directory; extract INVESTIGATION_ID from the filename (last 15 characters before .md).
Multiple files found: List them and ask the analyst which investigation to continue (show the artifact slug, ID, and modification time for each).

Read the chosen <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 2 — Spawn rl-fp-validate agent

Use the Task tool to spawn the rl-fp-validate agent. Pass the full contents of <ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md as its input.

Wait for the agent to return.

Step 3 — Write rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md

Write the agent's output to <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md.

Step 4 — Check for short-circuit

Read the Recommendation field from the findings:

CONCLUSIVE FP: Tell the analyst the finding is a false positive and explain the key signals. Tell them the pipeline will skip investigation, adjudication, and remediation. Proceed directly to rl-report (or inform the rl-soc orchestrator to short-circuit).
POSSIBLE FP / LIKELY TP / INSUFFICIENT DATA: Tell the analyst the FP confidence level and key signals. Proceed to rl-investigate (or inform the orchestrator to continue normally).

Step 5 — Report to analyst

Tell the analyst:

The FP recommendation and overall FP confidence
The top 2–3 signals driving the assessment
That <ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md has been written
The next step based on the recommendation