菜单
Use when scope-investigate completes an investigation and needs a facts-only analyst summary, evidence timeline, query appendix, investigation gaps, and optional saved investigation artifact.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when constructing SCOPE attack candidate chains from audit artifacts and rejecting facts that do not form attacker progressions.
Use when formatting SCOPE controls detection candidates into detections.md, detections.json, dashboard-readable SPL sections, or controls-schema detection records.
Use when attaching schema-valid SCOPE evidence handles to attack candidates, hops, observations, assumptions, and caveats.
Use when scope-exploit has operator-approved attack paths and needs to generate the narrative red team playbook, execution steps, persistence, post-exploitation, and IAM policy JSON without detection or SOC guidance.
Use when a SCOPE top-level agent starts a run and needs bounded environment knowledge, durable observations, reasoning notes, coverage gaps, and Splunk patterns before planning.
Use after SCOPE evidence review, final disposition, or operator-approved save to update durable environment knowledge, observations, coverage gaps, or proposed reasoning-note improvements.
| name | scope-investigation-report |
| description | Use when scope-investigate completes an investigation and needs a facts-only analyst summary, evidence timeline, query appendix, investigation gaps, and optional saved investigation artifact. |
Use this skill after the analyst chooses done in scope-investigate, before the save prompt and before durable knowledge updates.
The top-level investigation agent provides:
MODE: INVESTIGATION, RUN, or INTELactive_hypothesisinvestigation_contextinvestigation_findingsKNOWLEDGE_CONTEXTConsider:.KNOWLEDGE_CONTEXT entries only when they influenced reasoning.Return this structure:
## Investigation Summary
[2-5 sentences. State what the data showed, what the data did not show, and what remains unknown.]
## Evidence Timeline
| Timestamp (UTC) | Event | Principal | Source IP | Details |
|-----------------|-------|-----------|-----------|---------|
## Key Indicators Found
- [Observable fact]
## Investigation Gaps
- [Skipped step, missing telemetry, or unanswered question]
## Environment Context Used
| Entity | Knowledge Entry | How It Informed Investigation |
|--------|-----------------|-------------------------------|
## Suggested Follow-Up Actions
- Consider: [optional next step]
Omit Environment Context Used when no knowledge entry influenced the investigation.
When the analyst approves save, append:
## Queries Run
| Step | Purpose | SPL | Result Summary |
|------|---------|-----|----------------|
## Skipped Or Pivoted Steps
| Step | Status | Reason |
|------|--------|--------|
Return:
INVESTIGATION_REPORT
status: complete|skipped|error
sections:
- Investigation Summary
- Evidence Timeline
- Key Indicators Found
- Investigation Gaps
- Suggested Follow-Up Actions
save_ready: true|false
knowledge_update_candidates:
- ...