skills.rest
dandye
dandyeCOMMUNITY
Explore all skills by this author →
𝕏@dandyeGitHub

triage-suspicious-login

Triages suspicious login alerts and outputs LOGIN_VERDICT with risk scores.

120|34|Updated May 9, 2025
Search Tags:#risk-assessment#triage#anomaly-detection#SOC#security-operations#ip-enrichment#suspicious-login
One-click install
npx skills add https://github.com/dandye/ai-runbooks --skill triage-suspicious-login
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage-suspicious-login
Source: https://github.com/dandye/ai-runbooks/tree/main/skills/triage-suspicious-login
Command: npx skills add https://github.com/dandye/ai-runbooks --skill triage-suspicious-login

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Triage and adjudicate suspicious login alerts (impossible travel, untrusted location, multiple failed logins) to determine legitimacy and escalate when needed.

Core Features & Use Cases

  • Gather case context from SOAR and extract key entities (USER_ID, SOURCE_IP, HOSTNAME) for a login alert.
  • Enrich user and IP context using MCP and GTI data to assess risk and patterns.
  • Synthesize findings into a concise verdict and escalation recommendations for Tier 1-3 analysts.

Quick Start

Start triage by supplying CASE_ID and optional USER_ID or SOURCE_IP to initialize context gathering and enrichment.

Frequently Asked Questions about triage-suspicious-login

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage suspicious login alerts for impossible travel and untrusted locations?▼

To triage suspicious login alerts, this Skill assesses impossible travel, untrusted locations, and failed login sequences by leveraging user history, IP reputation, and login patterns. It produces a LOGIN_VERDICT, RISK_SCORE, and escalation recommendations.

What is the best way to determine if a suspicious login alert requires escalation during incident response?▼

Determining suspicious login escalation needs involves synthesizing enriched user and IP context using MCP and GTI data. The Skill evaluates related case context to generate actionable recommendations for Tier 1-3 analysts.

How do I start a SOC investigation for a suspicious login using a CASE_ID?▼

Start SOC suspicious login triage by supplying a CASE_ID along with an optional USER_ID or SOURCE_IP. This initializes context gathering and entity extraction from SOAR platforms to assess the alert's legitimacy.

Can I use this Skill for anomaly detection on multiple failed login sequences across user accounts?▼

Yes, this Skill supports anomaly detection for multiple failed login sequences across user accounts. It evaluates login patterns and related case context to determine the alert's legitimacy and calculate a RISK_SCORE.

Does triaging suspicious logins require external IP enrichment data?▼

Triaging suspicious logins leverages external IP enrichment data using MCP and GTI sources. This data assesses IP reputation and user patterns to accurately produce a LOGIN_VERDICT and risk recommendations.

Related Skills

Explore More Data & Analytics Skills→
menoncellomenoncello
3

deep-research

Automate multi-source research and generate structured business intelligence reports.

Community
Intermediate
sjinkssjinks

security-review-owasp-vulnerability-disclosure

Identify vulnerability disclosure control gaps in code, configuration, and workflows.

Community
Advanced
Liberty91LTDLiberty91LTD
15

abuseipdb-api

Query AbuseIPDB to check IP reputation and parse abuse reports.

Official
Intermediate
AlamatorAlamator

cyber-defense-team

Orchestrate multi-agent analysis of security logs to detect anomalies and generate incident reports.

Community
Advanced