「investigation」の検索結果

Design and operate a data integrity monitoring programme based on ALCOA+ principles. Covers detective controls, audit trail review schedules, anomaly detection patterns (off-hours activity, sequential modifications, bulk changes), metrics dashboards, investigation triggers, and escalation matrix definition. Use when establishing a data integrity monitoring programme for GxP systems, preparing for inspections where data integrity is a focus area, after a data integrity incident requiring enhanced monitoring, or when implementing MHRA, WHO, or PIC/S guidance.

日本語の概要は準備中です。原文の説明を表示しています。

AI solution exploration using ant colony optimization — deploying scout hypotheses, reinforcing promising approaches, detecting diminishing returns, and knowing when to abandon a strategy. Use when facing a problem with multiple plausible approaches and no clear winner, when the first approach is not working but alternatives are unclear, when debugging with no obvious root cause requiring parallel hypothesis investigation, or when previous attempts have converged prematurely on a suboptimal approach.

日本語の概要は準備中です。原文の説明を表示しています。

AI systematic knowledge acquisition from unfamiliar territory — deliberate model-building with feedback loops. Maps spaced repetition principles to AI reasoning: survey the territory, hypothesize structure, explore with probes, integrate findings, verify understanding, and consolidate for future retrieval. Use when encountering an unfamiliar codebase or domain, when a user asks about a topic requiring genuine investigation rather than recall, when multiple conflicting sources require building a coherent model, or when preparing to teach a topic and deep understanding is required first.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for a council, second opinions, or parallel investigation. Not for cross-examination of existing proposals: use cross-critique.

日本語の概要は準備中です。原文の説明を表示しています。

Use when independent proposals on a contested decision need cross-critique before choosing, reusing the original authors. Not for parallel multi-stance investigation: use council.

日本語の概要は準備中です。原文の説明を表示しています。

Investigate an Odylith bug record, gather evidence, and connect it to the right governed surfaces.

日本語の概要は準備中です。原文の説明を表示しています。

Before any multi-step work with a stated goal — a feature, a bugfix spanning multiple files, a QA sweep, a doc draft + iterations, a multi-day investigation — create an ATO Mission instead of doing it via bare `ato dispatch` calls. A Mission persists the goal + the verifiable success criteria, lets the coordinator tick drive the work across days, captures every event in a structured audit trail (SQLite + markdown narrative), and integrates parallel agents' work via merge strategies. Complement to `ato-warroom` (the cross-family decision before you start) and `ato-review` (the post-code-diff review). Missions is where multi-step work LIVES; war-rooms are where decisions ABOUT it get made; reviews are where the resulting commits get vetted. Fires when: the work has more than one decision point, a verifiable end state, or runs across more than one session. Use it for any ATO development that doesn't fit in a single dispatch.

日本語の概要は準備中です。原文の説明を表示しています。

Systematic debugging with root cause investigation. Four phases: investigate, analyze, hypothesize, implement. Iron Law: no fixes without root cause.

日本語の概要は準備中です。原文の説明を表示しています。

Choose the authorized worker channel and hand over complete engineering responsibilities, including in-scope self-check, repair and delivery. Use for substantial investigation, implementation, continuation and recovery; use swarm for approved independent batches. Respect the operator's standing ACP/native choice, explicit solo, and tiny or nearly finished work.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes Perfetto traces to find the root cause of latency, memory, or jank issues in Android apps. Use when the user provides a Perfetto trace file and asks any question, ongoing investigation, or open-ended request to analyze its contents.

日本語の概要は準備中です。原文の説明を表示しています。

行业调研——researcher CLI + 多 Agent 对抗式研究引擎。输入一个行业/赛道/商业机会的模糊需求， 输出一份有据可依、经过证据校验和红蓝对抗检验的战略调研报告。内置国民经济行业分类映射、 MECE/PESTLE/波特五力等咨询框架、事前验尸法和黑格尔辩证法合题引擎。 支持精简/标准/深度三种报告深度。 触发方式：/industry-research、「行业调研」、「行业分析」、「赛道研究」、「市场调研」 Use when the user asks for industry research, sector analysis, market study, competitive landscape analysis, investment thesis research, or any request involving structured industry investigation. Also trigger when user mentions 调研报告, 行业研究, 赛道分析, 商业机会分析, 投资逻辑梳理, or similar phrases. Even casual requests like "帮我看看 XX行业怎么样" or "XX赛道值不值得做" should trigger this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Use when facing 2+ independent tasks or investigations that can be worked on without shared state or sequential dependencies — fan out to specialized sub-agents with isolated context, then synthesize the results.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for a SIGMA detection rule, "write a SIGMA rule for X", or `/hash-investigation` / `/malware-analysis` surfaces behaviour worth a vendor-agnostic detection. Format spec + writing guide.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for a YARA rule, "write YARA for this sample/family", or `/hash-investigation` / `/malware-analysis` surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.

日本語の概要は準備中です。原文の説明を表示しています。

Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need Liberty91 platform intelligence — what actually happened (deduplicated Threat Events with every source, Admiralty reliability/credibility and verification stage), whether an IOC is already known to your account, the canonical threat library (actors, malware, vulnerabilities, clusters, ATT&CK TTPs), alert matches, or which of your customer organizations an occurrence affects — or when you need to push intelligence back: ingesting your own report, generating an intelligence package, or uploading an organization document. Also supplies event provenance fields, when the platform returns them, and Threat Library alias resolution to /source-provenance and /quality-of-information-check. Two-way, first-party integration. Commonly invoked by /ip-investigation and friends, /ioc-enrichment-workflow, /threat-actor-profiling, /campaign-tracking and /vulnerability-intelligence. Reads $LIBERTY91_API_KEY.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to query an OpenCTI instance — is this IOC already known, what entities/reports/campaigns exist for an actor — or push new intel into it — creating indicators/observables, labelling, TLP markings, relationships, or importing a STIX 2.1 bundle. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already in your knowledge base, and by analytical skills that want to publish their findings back to OpenCTI. Reads $OPENCTI_URL and $OPENCTI_TOKEN.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already known to your CTI sharing community, and by analytical skills that want to publish their findings back to MISP. Reads $MISP_URL and $MISP_API_KEY.

日本語の概要は準備中です。原文の説明を表示しています。

Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules, and when a user asks where a report or article comes from, how reliable it is, to grade a source, check a report, or split a report into claims, or pastes a bare article URL. Routes to the right investigation, provenance, grading or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need abuse-report history for an IPv4/IPv6 address — confidence score, total reports, distinct reporters, usage type. IP-only. Commonly invoked by /ip-investigation. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples by family). Commonly invoked by /hash-investigation and /malware-analysis. Other agents/skills can chain this for deeper malware enrichment beyond VirusTotal.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to check an IP, domain, file hash, or URL against AlienVault OTX community pulses. Returns pulse count, key pulses, tags, related indicators, and passive DNS. Commonly invoked by investigation skills to pull community context. Retrieval only — does not interpret.

日本語の概要は準備中です。原文の説明を表示しています。