find-relevant-case

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Search for existing cases related to specific indicators or entities. Use to find correlation with other investigations before starting new analysis. Takes search terms and returns matching case IDs.

场景案件调查威胁分析

适合你，如果需要在开始新分析前查找已有案件关联

/ 下载安装

https://github.com/dandye/ai-runbooks/tree/main/skills/find-relevant-case ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add dandye/ai-runbooks/find-relevant-case

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/find-relevant-case

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify dandye/ai-runbooks/find-relevant-case

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

119GitHub stars

~431上下文体积 · 单文件

索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准

它做什么

安装后，如果你给出IP、用户名等搜索词，Claude会搜索已有的相关案件，并返回匹配的案件ID和摘要信息。

什么时候触发

当你要求查找与某实体相关的已有案件，或说“查一下案件”时触发。

装好后可以这样说

Claude会返回与该IP匹配的案件列表。

Claude会列出匹配的案件ID和优先级。

技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Find Relevant Case Skill

Identify existing cases that may be related to the current investigation based on IOCs, hostnames, usernames, or other entities.

Inputs

SEARCH_TERMS - List of values to search for (e.g., ["198.51.100.10", "mikeross-pc", "jsmith"])
(Optional) CASE_STATUS_FILTER - Filter by status: "Opened", "Closed" (default: "Opened")
(Optional) TIME_FRAME_HOURS - Lookback period for case creation/update
(Optional) MAX_RESULTS - Maximum cases to return

Workflow

Step 1: Construct Search Filter

Build a filter for list_cases based on search terms and filters.

Note: The list_cases tool may have limited ability to search within case entities. If direct entity search isn't supported, use broader filters and refine results.

Step 2: Execute Search

secops-soar.list_cases(
    filter=constructed_filter,
    limit=MAX_RESULTS
)

Step 3: Process Results

Extract case IDs and basic details (DisplayName, Priority) from results.

Step 4: (Optional) Refine Results

If too many results, use get_case_full_details on a subset to verify entity presence:

secops-soar.get_case_full_details(case_id=candidate_case_id)

Outputs

| Output | Description | |--------|-------------| | RELEVANT_CASE_IDS | List of case IDs that match the search | | RELEVANT_CASE_SUMMARIES | Brief summaries (ID, name, priority) | | FIND_CASE_STATUS | Success/failure status of the search |

Limitations & Workarounds

The list_cases tool may not support direct entity searching. Alternatives:

Broader filters - Use time range, alert type, then manually review
SIEM correlation - Search SIEM for entity, check if events belong to a case
Multiple searches - Search each term separately, combine results

按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…