dandye/ai-runbooks/full-investigation

Name: full-investigation
Author: dandye

Claude Code and agent skill by dandye/ai-runbooks

Trust tier 2

community

By dandye
AI/ML
dandye/ai-runbooks
skills/_workflows/full-investigation/SKILL.md
Updated 30 Sep 2026
Version 1.0.12 versions recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.

Install

npx vskill@latest install dandye/ai-runbooks/full-investigation

SKILL.md

Full Investigation Workflow

A composite skill that orchestrates comprehensive Tier 2/3 investigation of escalated security cases.

Inputs

CASE_ID - The escalated case to investigate (required)
PRIMARY_IOCS - Key IOCs identified during Tier 1 triage (optional)
ALERT_TYPE - Type of alert (malware, authentication, network, etc.)
ESCALATION_REASON - Why this was escalated from Tier 1

Orchestrated Workflow

┌─────────────────────────────────────────────────────────────────┐
│                   FULL INVESTIGATION                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ESCALATED CASE                                                 │
│       │                                                         │
│       ▼                                                         │
│  ┌─────────────────────┐                                        │
│  │   /deep-dive-ioc    │  (for each primary IOC)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /correlate-ioc    │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────────────────┐                               │
│     │     ALERT TYPE ROUTING    │                               │
│     └───────────────────────────┘                               │
│             │                                                   │
│   ┌─────────┼───────────┬─────────┐                             │
│   ▼         ▼           ▼         ▼                             │
│ MALWARE   AUTH      NETWORK    OTHER                            │
│   │         │           │         │                             │
│   ▼         ▼           ▼         ▼                             │
│ /triage   /triage      /pivot   Continue                        │
│ -malware  -suspicious  -on-ioc  with pivoting                   │
│   │       -login        │         │                             │
│   └─────────┴───────────┴─────────┘                             │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /pivot-on-ioc     │  (expand investigation)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────┐                                           │
│     │   DECISION    │                                           │
│     └───────┬───────┘                                           │
│             │                                                   │
│   ┌─────────┼─────────┐                                         │
│   ▼         ▼         ▼                                         │
│ INCIDENT  RESOLVED  ESCALATE                                    │
│   │         │       TO IR                                       │
│   ▼         ▼         │                                         │
│ Create   /close       │                                         │
│ Incident  -case       │                                         │
│   │       -artifact   │                                         │
│   │         │         │                                         │
│   └─────────┴─────────┘                                         │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │  /generate-report   │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│            END                                                  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Detailed Steps

Phase 1: Deep Analysis

Step 1.0: Extract Primary IOCs (if not provided)

If PRIMARY_IOCS is not provided as input, extract key entities from the case:

secops-soar.get_case_full_details(case_id=CASE_ID)

From the case details, extract IOCs:

IP addresses from alert entities
Domain names from network indicators
File hashes from endpoint alerts
URLs from web security alerts

Populate PRIMARY_IOCS with extracted IOCs.

Step 1.1: Deep Dive on Primary IOCs

For each IOC in PRIMARY_IOCS:

Invoke: /deep-dive-ioc IOC_VALUE=$ioc CASE_ID=$CASE_ID

Collect:

GTI_DEEP_FINDINGS - Full threat intelligence analysis
SIEM_DEEP_CONTEXT - Detailed SIEM context
RELATED_ENTITIES - Discovered related IOCs and entities
THREAT_ATTRIBUTION - Any threat actor/campaign links

Step 1.2: Aggregate Discovered IOCs

Combine all RELATED_ENTITIES collected from deep-dive steps into ALL_DISCOVERED_IOCS:

ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(RELATED_ENTITIES from each deep-dive)

This aggregated list is used for correlation in Phase 2.

Phase 2: Correlation

Step 2.1: Correlate with Existing Cases

Invoke: /correlate-ioc IOC_LIST=$ALL_DISCOVERED_IOCS

Collect:

RELATED_CASES - Other cases with same IOCs
RELATED_ALERTS - Alerts involving same entities
PATTERN_ANALYSIS - Detected patterns across cases

Step 2.2: Find Related Open Cases

Invoke: /find-relevant-case with key entities

Document any linked investigations.

Phase 3: Specialized Analysis

Step 3.1: Route by Alert Type

Based on ALERT_TYPE, invoke specialized triage:

Alert Type	Skill	Focus
Malware	`/triage-malware`	File analysis, behavior, persistence
Authentication	`/triage-suspicious-login`	User activity, login patterns
Network	`/pivot-on-ioc`	Network IOC relationships
Other	Continue to pivoting	General IOC expansion

For Malware: Invoke: /triage-malware FILE_HASH=$hash CASE_ID=$CASE_ID

Collect:

Malware family identification
Behavioral analysis
Affected systems
Containment recommendations

For Authentication: Invoke: /triage-suspicious-login USER=$user CASE_ID=$CASE_ID

Collect:

Login anomaly analysis
User activity timeline
Compromised account indicators
Account status recommendations

Phase 4: Expansion

Step 4.1: Pivot on High-Confidence IOCs

For each high-confidence malicious IOC:

Invoke: /pivot-on-ioc IOC_VALUE=$ioc

Collect:

RELATED_INFRASTRUCTURE - Connected domains, IPs, files
CAMPAIGN_LINKS - Associated campaigns or actors
ADDITIONAL_IOCS - New IOCs to hunt for

Step 4.2: Validate Expanded IOCs

For significant new IOCs discovered:

Quick GTI lookup
SIEM presence check
Add to investigation scope if relevant

Phase 5: Assessment

Step 5.1: Determine Investigation Outcome

Assess all findings and classify:

Outcome	Criteria	Action
Incident Confirmed	Active compromise, ongoing threat	Escalate to IR
Resolved - Contained	Threat neutralized, no ongoing risk	Document & Close
Resolved - False Positive	Deep analysis confirms benign	Document & Close
Requires IR Escalation	Containment/eradication needed	Escalate to IR

Step 5.2: Execute Disposition

If Incident Confirmed / Requires IR:

Invoke: /document-in-case with full findings
Output escalation recommendation:

Recommend specific IR skill:
Ransomware indicators → /respond-ransomware
Malware persistence → /respond-malware
Phishing origin → /respond-phishing
Account compromise → /respond-compromised-account

Prepare handoff package for IR team

If Resolved:

Invoke: /document-in-case with:

Investigation summary
All queries and findings
Resolution rationale

If closing: Invoke: /close-case-artifact with appropriate reason

Phase 6: Documentation

Step 6.1: Generate Investigation Report

Invoke: /generate-report REPORT_TYPE=investigation

Include:

Executive summary
Investigation timeline
All IOCs analyzed (with verdicts)
SIEM queries used
GTI findings
Correlation results
Attack chain (if identified)
Recommendations
Lessons learned

Outputs

Output	Description
`INVESTIGATION_OUTCOME`	Incident, Resolved, or Escalated
`THREAT_ASSESSMENT`	Severity, scope, and attribution
`ALL_IOCS`	Complete list of analyzed IOCs with verdicts
`ATTACK_CHAIN`	Reconstructed attack timeline (if applicable)
`REPORT_PATH`	Path to investigation report
`ESCALATION_DETAILS`	If escalated, target and handoff package

Error Handling

If /deep-dive-ioc fails → Fall back to /enrich-ioc, continue
If GTI Enterprise features unavailable → Document limitation, use Standard features
If specialized triage fails → Document, continue with general analysis
If correlation timeout → Proceed with available data, note gap

Performance Targets

Total workflow time: < 2 hours
Deep dive per IOC: < 15 minutes
Correlation: < 10 minutes
Specialized triage: < 30 minutes
Report generation: < 15 minutes
Target accuracy: > 95% correct assessment

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewPassed

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingskills/_workflows/full-investigation/SKILL.md

Popularity

Repository stars: 127
Repository forks: 34
7-day trend score: 24

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 22 Mar 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dandye/ai-runbooks/full-investigation/badge)](https://verified-skill.com/skills/dandye/ai-runbooks/full-investigation)

Something wrong with this skill or its page? Tell us.