Vigil-SOC/vigil

Vigil-SOC/vigil

Skill Claude CodeCodex

Write a security report for a chosen audience - technical report, executive summary, or one-page board brief with RED/YELLOW/GREEN risk posture, key metrics, top 3 actions and 30/60/90 day trend. Use when asked for a report, summary, board brief, board report or risk posture report over cases and findings.

Vigil-SOC/vigil

Skill Claude CodeCodex

Enrich the indicators of compromise (IPs, domains, hashes, URLs) in a finding. Read this before looking up any IOC so the enrichment checks memory first, uses every intel source you hold in parallel, and states provenance and confidence per source.

Vigil-SOC/vigil

Skill Claude CodeCodex

Grade a periodic outbound flow as c2, suspicious, or benign-periodic. Read this when rawdata shows a repeating connection and you must separate a beacon from NTP, an update check, a monitoring agent, or telemetry.

Vigil-SOC/vigil

Skill Claude CodeCodex

Give a reported email a verdict, the lure, and the first action. Read this for a user-reported message, suspicious mail, or any finding that is an email.

Vigil-SOC/vigil

Skill Claude CodeCodex

Judge whether one internal RDP (Remote Desktop) session is lateral movement or an administrator doing their job. Read this for a finding on port 3389 or technique T1021.001 before deciding lateral-movement, suspicious, or expected-admin.

Vigil-SOC/vigil

Skill Claude CodeCodex

Check or add ATT&CK technique ids on a finding by grounding each id in an observable. Read this when a triage, investigation, or correlation agent is checking or adding technique ids on a finding.

Vigil-SOC/vigil

Skill Claude CodeCodex

Broad behavioural hunting across the findings detection already scored and the raw telemetry behind them.

Vigil-SOC/vigil

Skill Claude CodeCodex

How to move a hunt from its hypotheses to verdicts -- what to query next, when to validate, when to stop. Load at the start of a hunt.

Vigil-SOC/vigil

Skill Claude CodeCodex

Method for working one open case from its findings to a supported disposition. Load at the start of a case.

Vigil-SOC/vigil

Skill Claude CodeCodex

Traffic shape -- beaconing intervals, jitter, volume asymmetry, DNS and HTTP. Load when a hypothesis is about how hosts talk.

Vigil-SOC/vigil

Skill Claude CodeCodex

Exactly how to fill recordevidence -- sourcesystem, salience, payload, supports/weakens and restson authorship. Load before your first record.

Vigil-SOC/vigil

Skill Claude CodeCodex

Reputation and attribution for observables -- IPs, domains, URLs, hashes -- against the indicator database and connected intel.