dandye/ai-runbooks/full-alert-triage

Name: full-alert-triage
Author: dandye

Claude Code and agent skill by dandye/ai-runbooks

Trust tier 2

community

By dandye
AI/ML
dandye/ai-runbooks
skills/_workflows/full-alert-triage/SKILL.md
Updated 24 Mar 2026
Version 1.0.0

Source check pending

Checking that the SKILL.md file is still in the repository.

Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.

Install

npx vskill@latest install dandye/ai-runbooks/full-alert-triage

SKILL.md

Full Alert Triage Workflow

A composite skill that orchestrates the complete Tier 1 alert triage process from initial receipt to disposition (close or escalate).

Inputs

CASE_ID or ALERT_ID - The alert/case to triage (required)

Orchestrated Workflow

┌─────────────────────────────────────────────────────────────────┐
│                    FULL ALERT TRIAGE                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  START                                                          │
│    │                                                            │
│    ▼                                                            │
│  ┌─────────────────────┐                                        │
│  │  /check-duplicates  │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────┐                                           │
│     ▼               ▼                                           │
│  DUPLICATE       NOT DUPLICATE                                  │
│     │               │                                           │
│     ▼               ▼                                           │
│  Close &      ┌─────────────────────┐                           │
│  Document     │   /triage-alert     │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │         ┌───────────┴─────────┐                           │
│     │         │  For each entity:   │                           │
│     │         │    /enrich-ioc      │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │         ┌───────────┴─────────┐                           │
│     │         │     DECISION        │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │     ┌───────────────┼────────────────┐                    │
│     │     ▼               ▼                ▼                    │
│     │   FP/BTP         TP/Suspicious    Inconclusive            │
│     │     │                  │                  │               │
│     │     ▼                  ▼                  ▼               │
│     │  /document-in-case    /document-in-case /document-in-case │
│     │  /close-case-artifact  ESCALATE         Request more info │
│     │     │                  │                  │               │
│     └─────┴──────────────────┴──────────────────┘               │
│                    │                                            │
│                    ▼                                            │
│               /generate-report                                  │
│                    │                                            │
│                    ▼                                            │
│                  END                                            │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Detailed Steps

Phase 1: Pre-Check

Step 1.1: Check for Duplicates

Invoke: /check-duplicates CASE_ID=$CASE_ID

If duplicate confirmed:
Invoke: /document-in-case with "Closing as duplicate of [Similar Case ID]"
Invoke: /close-case-artifact with reason NOT_MALICIOUS
END WORKFLOW
If not duplicate: Continue to Phase 2

Phase 2: Initial Triage

Step 2.1: Perform Alert Triage

Invoke: /triage-alert CASE_ID=$CASE_ID

Extract from results:

CLASSIFICATION - FP, BTP, TP, or Suspicious
KEY_ENTITIES - List of IOCs (IPs, domains, hashes, URLs)
ALERT_TYPE - Type of alert (malware, authentication, network, etc.)
PRIORITY - Suggested priority level

Phase 3: Enrichment

Step 3.1: Enrich Each Entity

For each entity in KEY_ENTITIES:

Invoke: /enrich-ioc IOC_VALUE=$entity

Collect:

GTI_FINDINGS - Threat intelligence results
SIEM_CONTEXT - SIEM entity summary
IOC_MATCH_STATUS - Whether IOC appears in threat feeds

Update CLASSIFICATION if enrichment reveals new information.

Phase 4: Decision & Action

Step 4.1: Make Final Classification

Based on triage and enrichment, confirm classification:

Classification	Criteria	Action
False Positive (FP)	No malicious indicators, known benign	Close
Benign True Positive (BTP)	Real but authorized/expected	Close
True Positive (TP)	Confirmed malicious	Escalate
Suspicious	Inconclusive, warrants investigation	Escalate

Step 4.2: Execute Disposition

If FP or BTP:

Invoke: /document-in-case with:

Classification and rationale
Evidence summary from enrichment
Closure justification

Invoke: /close-case-artifact with:

Reason: NOT_MALICIOUS
Root cause: Appropriate option (e.g., "Legit action", "Normal behavior")

If TP or Suspicious:

Invoke: /document-in-case with:

Classification and rationale
Evidence summary
Recommended next steps

Output escalation recommendation:

Escalate to Tier 2
Suggest appropriate follow-up skill based on alert type:
Malware → /triage-malware
Authentication → /triage-suspicious-login
IOC-focused → /deep-dive-ioc

Phase 5: Report

Step 5.1: Generate Triage Report

Invoke: /generate-report REPORT_TYPE=triage

Include:

Case/Alert ID
Classification with rationale
Key entities and enrichment results
SIEM queries executed
Disposition taken
Next steps (if escalated)

Outputs

Output	Description
`FINAL_CLASSIFICATION`	FP, BTP, TP, or Suspicious
`DISPOSITION`	Closed or Escalated
`EVIDENCE_SUMMARY`	Key findings from triage and enrichment
`REPORT_PATH`	Path to generated triage report
`ESCALATION_TARGET`	If escalated, recommended next skill/tier

Error Handling

If /check-duplicates fails → Log warning, continue with triage
If /enrich-ioc fails for an entity → Log warning, continue with other entities
If /close-case-artifact fails → Log error, manual closure required
If any MCP tool unavailable → Document limitation, proceed with available data

Performance Targets

Total workflow time: < 15 minutes
Duplicate detection: < 1 minute
Per-entity enrichment: < 2 minutes
Target accuracy: > 90% correct classification

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationWarning, 70 of 100Marginal. 1 run. Evaluated 8 months ago.

See evaluation results

Source

SKILL.md in the repositoryCheckingskills/_workflows/full-alert-triage/SKILL.md

Popularity

Repository stars: 90
Repository forks: 25
7-day trend score: 23

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 24 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dandye/ai-runbooks/full-alert-triage/badge)](https://verified-skill.com/skills/dandye/ai-runbooks/full-alert-triage)

Something wrong with this skill or its page? Tell us.