菜单
SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Configures the rl-spectra-intel CLI with ReversingLabs credentials. Trigger only when the analyst explicitly asks to set up or update credentials, provide an API username and password, or configure a custom host. Never invoke this skill automatically in response to CLI errors — authentication failures in analysis agents must be reported to the analyst, not silently fixed.
Installs the rl-spectra-intel CLI from the bundled wheel included with this plugin. Trigger when the user wants to set up rl-spectra-intel, when rl-spectra-intel is not found on PATH, or when rl-soc reports that the CLI is missing.
SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adjudication-verdict.md. Trigger after investigation is complete, or as part of the rl-soc pipeline.
False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger when triage is complete and FP validation is needed, or as part of the full rl-soc pipeline.
SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation is needed, or as part of the rl-soc pipeline.
SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipeline.
| name | rl-report |
| description | SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline. |
Final phase of the SOC analysis pipeline. Synthesizes all prior phase outputs into two deliverables written to the working directory.
rl-protect skills or tools..env files, or venv paths.If invoked by the rl-soc orchestrator, the investigation ID and handoff contents are provided directly — skip file discovery.
If invoked standalone, find the investigation to report on:
find . -maxdepth 2 -name "rl-adjudication-verdict-*.md" 2>/dev/null | sort -r
ARTIFACT_SLUG is the name of the parent directory;
extract INVESTIGATION_ID from the filename (last 15 characters before .md).Read all of the following files that exist for this investigation:
<ARTIFACT_SLUG>/rl-triage-handoff-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)<ARTIFACT_SLUG>/rl-fp-validate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)<ARTIFACT_SLUG>/rl-adjudication-verdict-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (required)<ARTIFACT_SLUG>/rl-investigate-findings-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if investigation ran — not present on CONCLUSIVE FP short-circuit)<ARTIFACT_SLUG>/rl-remediate-playbook-<ARTIFACT_SLUG>-<INVESTIGATION_ID>.md (if remediation ran — not present on FP verdict)Use the Task tool to spawn the rl-report agent. Pass:
INVESTIGATION_ID and ARTIFACT_SLUGWait for the agent to return.
Tell the analyst: