SKILL.md
Full Investigation Workflow
A composite skill that orchestrates comprehensive Tier 2/3 investigation of escalated security cases.
Inputs
CASE_ID- The escalated case to investigate (required)PRIMARY_IOCS- Key IOCs identified during Tier 1 triage (optional)ALERT_TYPE- Type of alert (malware, authentication, network, etc.)ESCALATION_REASON- Why this was escalated from Tier 1
Orchestrated Workflow
┌─────────────────────────────────────────────────────────────────┐
│ FULL INVESTIGATION │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ESCALATED CASE │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /deep-dive-ioc │ (for each primary IOC) │
│ └──────────┬──────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /correlate-ioc │ │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────────────────┐ │
│ │ ALERT TYPE ROUTING │ │
│ └───────────────────────────┘ │
│ │ │
│ ┌─────────┼───────────┬─────────┐ │
│ ▼ ▼ ▼ ▼ │
│ MALWARE AUTH NETWORK OTHER │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ /triage /triage /pivot Continue │
│ -malware -suspicious -on-ioc with pivoting │
│ │ -login │ │ │
│ └─────────┴───────────┴─────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /pivot-on-ioc │ (expand investigation) │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────┐ │
│ │ DECISION │ │
│ └───────┬───────┘ │
│ │ │
│ ┌─────────┼─────────┐ │
│ ▼ ▼ ▼ │
│ INCIDENT RESOLVED ESCALATE │
│ │ │ TO IR │
│ ▼ ▼ │ │
│ Create /close │ │
│ Incident -case │ │
│ │ -artifact │ │
│ │ │ │ │
│ └─────────┴─────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /generate-report │ │
│ └──────────┬──────────┘ │
│ │ │
│ ▼ │
│ END │
│ │
└─────────────────────────────────────────────────────────────────┘Detailed Steps
Phase 1: Deep Analysis
Step 1.0: Extract Primary IOCs (if not provided)
If PRIMARY_IOCS is not provided as input, extract key entities from the case:
secops-soar.get_case_full_details(case_id=CASE_ID)From the case details, extract IOCs:
- IP addresses from alert entities
- Domain names from network indicators
- File hashes from endpoint alerts
- URLs from web security alerts
Populate PRIMARY_IOCS with extracted IOCs.
Step 1.1: Deep Dive on Primary IOCs
For each IOC in PRIMARY_IOCS:
Invoke: /deep-dive-ioc IOCVALUE=$ioc CASEID=$CASE_ID
Collect:
GTIDEEPFINDINGS- Full threat intelligence analysisSIEMDEEPCONTEXT- Detailed SIEM contextRELATED_ENTITIES- Discovered related IOCs and entitiesTHREAT_ATTRIBUTION- Any threat actor/campaign links
Step 1.2: Aggregate Discovered IOCs
Combine all RELATEDENTITIES collected from deep-dive steps into ALLDISCOVERED_IOCS:
ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(RELATED_ENTITIES from each deep-dive)This aggregated list is used for correlation in Phase 2.
Phase 2: Correlation
Step 2.1: Correlate with Existing Cases
Invoke: /correlate-ioc IOCLIST=$ALLDISCOVERED_IOCS
Collect:
RELATED_CASES- Other cases with same IOCsRELATED_ALERTS- Alerts involving same entitiesPATTERN_ANALYSIS- Detected patterns across cases
Step 2.2: Find Related Open Cases
Invoke: /find-relevant-case with key entities
Document any linked investigations.
Phase 3: Specialized Analysis
Step 3.1: Route by Alert Type
Based on ALERT_TYPE, invoke specialized triage:
| Alert Type | Skill | Focus |
|---|---|---|
| Malware | /triage-malware |
File analysis, behavior, persistence |
| Authentication | /triage-suspicious-login |
User activity, login patterns |
| Network | /pivot-on-ioc |
Network IOC relationships |
| Other | Continue to pivoting | General IOC expansion |
For Malware: Invoke: /triage-malware FILEHASH=$hash CASEID=$CASE_ID
Collect:
- Malware family identification
- Behavioral analysis
- Affected systems
- Containment recommendations
For Authentication: Invoke: /triage-suspicious-login USER=$user CASEID=$CASEID
Collect:
- Login anomaly analysis
- User activity timeline
- Compromised account indicators
- Account status recommendations
Phase 4: Expansion
Step 4.1: Pivot on High-Confidence IOCs
For each high-confidence malicious IOC:
Invoke: /pivot-on-ioc IOC_VALUE=$ioc
Collect:
RELATED_INFRASTRUCTURE- Connected domains, IPs, filesCAMPAIGN_LINKS- Associated campaigns or actorsADDITIONAL_IOCS- New IOCs to hunt for
Step 4.2: Validate Expanded IOCs
For significant new IOCs discovered:
- Quick GTI lookup
- SIEM presence check
- Add to investigation scope if relevant
Phase 5: Assessment
Step 5.1: Determine Investigation Outcome
Assess all findings and classify:
| Outcome | Criteria | Action |
|---|---|---|
| Incident Confirmed | Active compromise, ongoing threat | Escalate to IR |
| Resolved - Contained | Threat neutralized, no ongoing risk | Document & Close |
| Resolved - False Positive | Deep analysis confirms benign | Document & Close |
| Requires IR Escalation | Containment/eradication needed | Escalate to IR |
Step 5.2: Execute Disposition
If Incident Confirmed / Requires IR:
- Invoke:
/document-in-casewith full findings - Output escalation recommendation:
- Recommend specific IR skill: - Ransomware indicators → /respond-ransomware - Malware persistence → /respond-malware - Phishing origin → /respond-phishing - Account compromise → /respond-compromised-account
- Prepare handoff package for IR team
If Resolved:
- Invoke:
/document-in-casewith:
- Investigation summary - All queries and findings - Resolution rationale
- If closing: Invoke:
/close-case-artifactwith appropriate reason
Phase 6: Documentation
Step 6.1: Generate Investigation Report
Invoke: /generate-report REPORT_TYPE=investigation
Include:
- Executive summary
- Investigation timeline
- All IOCs analyzed (with verdicts)
- SIEM queries used
- GTI findings
- Correlation results
- Attack chain (if identified)
- Recommendations
- Lessons learned
Outputs
| Output | Description |
|---|---|
INVESTIGATION_OUTCOME |
Incident, Resolved, or Escalated |
THREAT_ASSESSMENT |
Severity, scope, and attribution |
ALL_IOCS |
Complete list of analyzed IOCs with verdicts |
ATTACK_CHAIN |
Reconstructed attack timeline (if applicable) |
REPORT_PATH |
Path to investigation report |
ESCALATION_DETAILS |
If escalated, target and handoff package |
Error Handling
- If
/deep-dive-iocfails → Fall back to/enrich-ioc, continue - If GTI Enterprise features unavailable → Document limitation, use Standard features
- If specialized triage fails → Document, continue with general analysis
- If correlation timeout → Proceed with available data, note gap
Performance Targets
- Total workflow time: < 2 hours
- Deep dive per IOC: < 15 minutes
- Correlation: < 10 minutes
- Specialized triage: < 30 minutes
- Report generation: < 15 minutes
- Target accuracy: > 95% correct assessment