secops-investigate

What problem does it solve?

This Skill provides expert guidance for conducting thorough security investigations when users ask to investigate a case, entity, or incident.

Core Features & Use Cases

• Step-by-step investigation procedures for common security scenarios such as malware, lateral movement, and case closure.
• Tool-agnostic guidance on selecting between remote tools and local data sources, using reference mappings, and performing enrichment and case correlation.
• Documentation and reporting guidelines for generating SOAR entries and formal investigation reports.

Quick Start

Ask the assistant to start an investigation on a specific case or entity. For example: Investigate CASE_ID for a suspected malware incident and summarize findings.