スキルを探す

Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.

日本語の概要は準備中です。原文の説明を表示しています。

VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.

日本語の概要は準備中です。原文の説明を表示しています。

Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need Liberty91 platform intelligence — what actually happened (deduplicated Threat Events with every source, Admiralty reliability/credibility and verification stage), whether an IOC is already known to your account, the canonical threat library (actors, malware, vulnerabilities, clusters, ATT&CK TTPs), alert matches, or which of your customer organizations an occurrence affects — or when you need to push intelligence back: ingesting your own report, generating an intelligence package, or uploading an organization document. Also supplies event provenance fields, when the platform returns them, and Threat Library alias resolution to /source-provenance and /quality-of-information-check. Two-way, first-party integration. Commonly invoked by /ip-investigation and friends, /ioc-enrichment-workflow, /threat-actor-profiling, /campaign-tracking and /vulnerability-intelligence. Reads $LIBERTY91_API_KEY.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to query an OpenCTI instance — is this IOC already known, what entities/reports/campaigns exist for an actor — or push new intel into it — creating indicators/observables, labelling, TLP markings, relationships, or importing a STIX 2.1 bundle. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already in your knowledge base, and by analytical skills that want to publish their findings back to OpenCTI. Reads $OPENCTI_URL and $OPENCTI_TOKEN.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples by family). Commonly invoked by /hash-investigation and /malware-analysis. Other agents/skills can chain this for deeper malware enrichment beyond VirusTotal.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need host reconnaissance for an IP or domain — open ports, services, banners, OS detection, vulnerabilities. For domains, resolves DNS first then queries the IP. Commonly invoked by /ip-investigation and /domain-investigation. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to submit a URL for live scanning via URLScan.io and retrieve results, or search existing scans for a domain. Returns verdict, final URL after redirects, resolved IP, contacted domains/IPs, and screenshot URL. Commonly invoked by /url-investigation and /domain-investigation.

日本語の概要は準備中です。原文の説明を表示しています。

CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.

日本語の概要は準備中です。原文の説明を表示しています。

AbuseIPDB API reference. IP reputation and abuse report lookups.

日本語の概要は準備中です。原文の説明を表示しています。

Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Use when assigning a confidence level to an analytical judgment, the user asks "how confident are we?" / "what is the confidence on X?", or the orchestrator's tradecraft pipeline calls for a confidence level before publishing. Provides three named levels (High, Moderate, Low) with 0-100 score ranges aligned to STIX, and the rule that confidence cannot exceed what the weakest load-bearing claim supports.

日本語の概要は準備中です。原文の説明を表示しています。

Use when challenging a prevailing analytical judgment, the user asks "what is the opposing case?" / "argue the other side" / "play devil's advocate", or wants an assessment stress-tested before release. Takes the team's own lead judgment and builds the strongest case that it is wrong. A contrarian technique. It does not model what an adversary would do next, which is Red Team Analysis. Formerly /red-team-analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks "what is coming next?", wants strategic forecasting, or is hunting weak signals of emerging threats before they materialise. Covers signal identification, trend analysis, and scenario development.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need CrowdStrike Falcon Intelligence on an indicator (IOC reputation for an IP, domain, hash, or URL — malicious confidence, linked actors, malware families, reports) OR on an adversary (threat-actor profile, origin/target search, MITRE ATT&CK TTPs, finished intel reports). Answers questions like "look up 1.1.1.1", "what TTPs does Charming Kitten use?", "which threat actors operate from Russia?", and "latest report on Mustang Panda". Commonly invoked by the four /*-investigation skills, /ioc-enrichment-workflow, /threat-actor-profiling, and the regional espionage cells. Other agents/skills can chain this for vendor-authoritative actor and finished-intel context. Requires a Falcon Intelligence subscription.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already known to your CTI sharing community, and by analytical skills that want to publish their findings back to MISP. Reads $MISP_URL and $MISP_API_KEY.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to check an IP, domain, file hash, or URL against AlienVault OTX community pulses. Returns pulse count, key pulses, tags, related indicators, and passive DNS. Commonly invoked by investigation skills to pull community context. Retrieval only — does not interpret.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.

日本語の概要は準備中です。原文の説明を表示しています。