close-case-artifact

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.

场景告警研判事件处置误报标记

适合你，如果需要在安全运营中规范关闭告警或案件。

/ 下载安装

https://github.com/dandye/ai-runbooks/tree/main/skills/close-case-artifact ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add dandye/ai-runbooks/close-case-artifact

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/close-case-artifact

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify dandye/ai-runbooks/close-case-artifact

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

119GitHub stars

~426上下文体积 · 单文件

索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准

它做什么

装上后，Claude 可以帮你关闭安全案件或告警，需要提供案件/告警 ID、类型、关闭理由、根本原因和备注。关闭理由包括：恶意、非恶意、维护、不确定、未知。

什么时候触发

当安全人员判断告警是误报或调查完成需要关闭案件时触发。需要用户提供案件 ID、关闭理由等信息。

装好后可以这样说

Claude 会执行关闭操作并返回状态。

需要预先获取根本原因列表。

技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

Inputs

ARTIFACT_ID - The ID of the case or alert to close
ARTIFACT_TYPE - Either "Case" or "Alert"
CLOSURE_REASON - Must be one of:
MALICIOUS - Confirmed threat
NOT_MALICIOUS - False positive or benign
MAINTENANCE - System/maintenance activity
INCONCLUSIVE - Unable to determine
UNKNOWN - Unknown/other
ROOT_CAUSE - Must match a predefined root cause (use get_case_settings_root_causes to list options)
CLOSURE_COMMENT - Detailed justification for closure
(Optional) ALERT_GROUP_IDENTIFIERS - Alert group identifiers
(Optional, for alerts) ASSIGN_TO_USER - User to assign closed alert to
(Optional, for alerts) TAGS - Comma-separated tags

Workflow

Step 1: Execute Closure

For Cases:

secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)

For Alerts:

secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)

Outputs

| Output | Description | |--------|-------------| | CLOSURE_STATUS | Success/failure status of the closure |

Common Closure Patterns

| Scenario | Reason | Typical Root Cause | |----------|--------|-------------------| | False Positive | NOT_MALICIOUS | "Legit action", "Normal behavior" | | Duplicate | NOT_MALICIOUS | "Similar case is already under investigation" | | Benign True Positive | NOT_MALICIOUS | "Legit action" | | Confirmed Threat (remediated) | MALICIOUS | Varies by threat type | | Unable to determine | INCONCLUSIVE | "Insufficient data" |

Get Valid Root Causes

If unsure of valid root cause values:

secops-soar.get_case_settings_root_causes()

按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…