orca-morning-briefing

Orca Morning Briefing Skill

Answers the question: "What happened while I was away, and what needs my attention?"

Provides a security briefing for the last 24-72 hours covering new critical alerts, escalated alerts, attack path changes, compliance drift, exposure changes, CDR activity anomalies, crown jewel risks, and aging unactioned alerts.

Usage

/orca-morning-briefing
/orca-morning-briefing 72h
/orca-morning-briefing week

Or natural language:

• "morning briefing"
• "what happened overnight?"
• "brief me on the last 72 hours"
• "daily security summary"
• "what's new since yesterday?"

Time Range

Argument	Period	When to Use
(none)	Last 24 hours	Daily morning check
72h	Last 3 days	Monday morning / after weekend
week	Last 7 days	Weekly review / returning from PTO

Map these to CDR time_range enum values:

• 24h → "last_24_hours"
• 72h → "last_3_days"
• week → "last_7_days"

Processing Logic

Data Gathering Phase

Run ALL of the following queries in parallel to minimize latency. Do not wait for one to finish before starting the next.

Group 1: Alert Queries (via discovery_search)

Run these discovery_search queries in parallel:

Query 1a: New critical alerts

discovery_search:
  search_phrase: "critical open alerts"
  limit: 10

Query 1b: New high alerts

discovery_search:
  search_phrase: "high severity open alerts"
  limit: 10

Query 1c: Alerts on crown jewel assets

discovery_search:
  search_phrase: "open alerts on crown jewel assets"
  limit: 10

Query 1d: Internet-facing assets with critical vulnerabilities

discovery_search:
  search_phrase: "internet facing assets with critical vulnerabilities"
  limit: 10

Query 1e: New attack paths

discovery_search:
  search_phrase: "critical attack paths"
  limit: 10

Group 2: Compliance Queries

Run these in parallel:

Query 2a: Current compliance scores

get_enabled_compliance_frameworks:
  (no filters — get all frameworks)