Use when the user asks "what TLP should this be?", applying TLP markings to a finished product, or the tradecraft pipeline calls for TLP determination before sharing. Covers TLP v2.0 (CLEAR / GREEN / AMBER / AMBER+STRICT / RED).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about infostealer families (LummaC2, RedLine, Vidar, Stealc, Raccoon, Rhadamanthys, etc.), log marketplaces (Russian Market, Genesis successors, BidenCash, Hudson Rock corpus), or stealer-driven incidents and credential exposure. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Workflow for enriching raw IOCs. Routes each IOC type to the appropriate /lookup-* skills, optionally correlates against MISP, and synthesises a single enrichment record per indicator. Use when the user has a batch of raw IOCs to process before triage or before pushing into a sharing platform.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
IOC export formats and procedures. CSV, STIX 2.1, OpenIOC, MISP. Handles format conversion and packaging, and carries per-claim evidence grades (access level and claim support) from /quality-of-information-check into each format (STIX confidence, MISP attribute tags).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need deep host + certificate reconnaissance for an IP or need to run a Censys search query. Returns services, TLS certificates, ASN, and location. Free tier is severely limited (250 queries/month) — use sparingly. Retrieval only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need CrowdStrike Falcon Intelligence on an indicator (IOC reputation for an IP, domain, hash, or URL — malicious confidence, linked actors, malware families, reports) OR on an adversary (threat-actor profile, origin/target search, MITRE ATT&CK TTPs, finished intel reports). Answers questions like "look up 1.1.1.1", "what TTPs does Charming Kitten use?", "which threat actors operate from Russia?", and "latest report on Mustang Panda". Commonly invoked by the four /*-investigation skills, /ioc-enrichment-workflow, /threat-actor-profiling, and the regional espionage cells. Other agents/skills can chain this for vendor-authoritative actor and finished-intel context. Requires a Falcon Intelligence subscription.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need Liberty91 platform intelligence — what actually happened (deduplicated Threat Events with every source, Admiralty reliability/credibility and verification stage), whether an IOC is already known to your account, the canonical threat library (actors, malware, vulnerabilities, clusters, ATT&CK TTPs), alert matches, or which of your customer organizations an occurrence affects — or when you need to push intelligence back: ingesting your own report, generating an intelligence package, or uploading an organization document. Also supplies event provenance fields, when the platform returns them, and Threat Library alias resolution to /source-provenance and /quality-of-information-check. Two-way, first-party integration. Commonly invoked by /ip-investigation and friends, /ioc-enrichment-workflow, /threat-actor-profiling, /campaign-tracking and /vulnerability-intelligence. Reads $LIBERTY91_API_KEY.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already known to your CTI sharing community, and by analytical skills that want to publish their findings back to MISP. Reads $MISP_URL and $MISP_API_KEY.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to query an OpenCTI instance — is this IOC already known, what entities/reports/campaigns exist for an actor — or push new intel into it — creating indicators/observables, labelling, TLP markings, relationships, or importing a STIX 2.1 bundle. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already in your knowledge base, and by analytical skills that want to publish their findings back to OpenCTI. Reads $OPENCTI_URL and $OPENCTI_TOKEN.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples by family). Commonly invoked by /hash-investigation and /malware-analysis. Other agents/skills can chain this for deeper malware enrichment beyond VirusTotal.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need host reconnaissance for an IP or domain — open ports, services, banners, OS detection, vulnerabilities. For domains, resolves DNS first then queries the IP. Commonly invoked by /ip-investigation and /domain-investigation. Retrieval only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to submit a URL for live scanning via URLScan.io and retrieve results, or search existing scans for a domain. Returns verdict, final URL after redirects, resolved IP, contacted domains/IPs, and screenshot URL. Commonly invoked by /url-investigation and /domain-investigation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to check an IP, domain, file hash, or URL against VirusTotal's reputation database. Returns detection ratio, verdict, community score, and key findings. Commonly invoked by investigation skills (/ip-investigation, /domain-investigation, /hash-investigation, /url-investigation) and by analysts enriching IOCs. Other agents/skills can chain this for VirusTotal enrichment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.