dandye

dandye/ai-runbooks

Instructions file

Instructions for dandye/ai-runbooks.

dandye/ai-runbooks

Instructions file Gemini CLI

Instructions for dandye/ai-runbooks.

dandye/ai-runbooks

Skill Claude CodeCodex

Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.

dandye/ai-runbooks

Skill Claude CodeCodex

Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.

dandye/ai-runbooks

Skill Claude CodeCodex

Identify content gaps and organizational opportunities. Analyzes missing content areas, redundancies, and consolidation opportunities.

dandye/ai-runbooks

Skill Claude CodeCodex

Comprehensive content quality and maintenance assessment. Evaluates documentation quality, relevance, maintenance needs, and provides actionable recommendations.

dandye/ai-runbooks

Skill Claude CodeCodex

Check for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASEID and returns list of similar cases.

dandye/ai-runbooks

Skill Claude CodeCodex

Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.

dandye/ai-runbooks

Skill Claude CodeCodex

Automated content similarity and grouping analysis. Groups related documents by topic, purpose, or content similarity.

dandye/ai-runbooks

Skill Claude CodeCodex

Ask the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response.

dandye/ai-runbooks

Skill Claude CodeCodex

Check for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.

dandye/ai-runbooks

Skill Claude CodeCodex

Perform exhaustive analysis of a critical IOC. Use when an IOC needs Tier 2+ investigation beyond basic enrichment - includes GTI pivoting, deep SIEM searches, correlation with related entities, and threat attribution. For escalated IOCs requiring comprehensive investigation.

dandye/ai-runbooks

Skill Claude CodeCodex

Design comprehensive metadata frameworks. Develops structured metadata templates and tagging systems.

dandye/ai-runbooks

Skill Claude CodeCodex

Add a comment to a case to document findings, actions, or recommendations. Use to maintain audit trail during investigations. Requires CASEID and comment text.

dandye/ai-runbooks

Skill Claude CodeCodex

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

dandye/ai-runbooks

Skill Claude CodeCodex

Search for existing cases related to specific indicators or entities. Use to find correlation with other investigations before starting new analysis. Takes search terms and returns matching case IDs.

dandye/ai-runbooks

Skill Claude CodeCodex

Save investigation findings to a markdown report file. Use after completing triage, enrichment, or investigation to create a permanent record. Generates timestamped files in ./reports/ directory.

dandye/ai-runbooks

Skill Claude CodeCodex

Generate hierarchical site structure and navigation maps. Creates visual representations of information architecture and content relationships.

dandye/ai-runbooks

Skill Claude CodeCodex

Develop hierarchical classification systems. Creates parent-child categorical structures for content organization.

dandye/ai-runbooks

Skill Claude CodeCodex

Generate controlled vocabulary thesaurus for content domains. Creates comprehensive thesauri with preferred terms, broader/narrower/related terms.

dandye/ai-runbooks

Skill Claude CodeCodex

Hunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings.

dandye/ai-runbooks

Skill Claude CodeCodex

Hunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.

dandye/ai-runbooks

Skill Claude CodeCodex

Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.

dandye/ai-runbooks

Skill Claude CodeCodex

Hunt for lateral movement using PsExec, WMI, or similar techniques. Use when proactively searching for attackers moving through your network using admin tools. Searches for service installations, remote process execution, and suspicious network correlations.