mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
update enrichment
This commit is contained in:
rookit
@@ -35,7 +35,7 @@ Use this skill for alert-centric SOC work on ASP.
|
||||
- For updates, change only the fields the user explicitly requested.
|
||||
- For append actions, confirm the target alert ID and the minimum required payload before writing.
|
||||
- For attachment flows, distinguish between creating a new related record and reusing an existing one. Attach tools need
|
||||
the related record row ID.
|
||||
the related record rowid.
|
||||
- If the user wants to save structured analysis back onto the alert, use the `asp-enrichment-en` skill.
|
||||
|
||||
## Decision Flow
|
||||
@@ -46,7 +46,7 @@ Use this skill for alert-centric SOC work on ASP.
|
||||
3. If the user asks to browse or compare alerts, call `list_alerts` with supported filters.
|
||||
4. If the user asks to update AI severity, AI confidence, or AI comment, call `update_alert`.
|
||||
5. If the user asks to add an IOC, host, user, URL, or hash to the alert, first call `create_artifact` for a new
|
||||
artifact or locate an existing artifact row ID, then call
|
||||
artifact or locate an existing artifact rowid, then call
|
||||
`attach_artifact_to_alert(alert_id=<alert_id>, artifact_rowid=<artifact_rowid>)`.
|
||||
6. If the user asks to attach analysis results, intel, or structured context to the alert, use the `asp-enrichment-en`
|
||||
skill.
|
||||
@@ -97,8 +97,8 @@ Then add one short interpretation line when useful.
|
||||
1. Require `alert_id`.
|
||||
2. If the user wants a new artifact, collect the smallest useful artifact payload first: usually `value`, and when
|
||||
possible `name`, `type`, or `role`.
|
||||
3. For a new artifact, call `create_artifact` and keep the returned artifact row ID.
|
||||
4. For an existing artifact, first retrieve it and keep the returned artifact row ID.
|
||||
3. For a new artifact, call `create_artifact` and keep the returned artifact rowid.
|
||||
4. For an existing artifact, first retrieve it and keep the returned artifact rowid.
|
||||
5. Call `attach_artifact_to_alert(alert_id=<alert_id>, artifact_rowid=<artifact_rowid>)`.
|
||||
6. Confirm that the artifact is attached.
|
||||
7. If the artifact is likely to need context, suggest creating enrichment for the artifact or the alert next.
|
||||
|
||||
@@ -21,7 +21,7 @@ Use this skill for artifact-centric investigation work on ASP.
|
||||
- The user wants to find artifacts by value, type, role, owner, or reputation.
|
||||
- The user wants to create a new artifact record.
|
||||
- The user wants to attach a newly created artifact to an alert.
|
||||
- The user wants to attach an existing artifact to an alert when they already have the artifact row ID.
|
||||
- The user wants to attach an existing artifact to an alert when they already have the artifact rowid.
|
||||
- The user wants to attach enrichment or structured analysis to an artifact.
|
||||
|
||||
## Operating Rules
|
||||
@@ -31,7 +31,7 @@ Use this skill for artifact-centric investigation work on ASP.
|
||||
- Collect only missing required inputs.
|
||||
- Use `list_artifacts` for lookup and review.
|
||||
- Use `create_artifact` when the user wants to add a new artifact record.
|
||||
- Use `attach_artifact_to_alert` only after you already have an artifact row ID.
|
||||
- Use `attach_artifact_to_alert` only after you already have an artifact rowid.
|
||||
- Use `create_enrichment` plus `attach_enrichment_to_target` when the user wants to save analysis on the artifact
|
||||
itself.
|
||||
- For detailed enrichment persistence workflow, use the `asp-enrichment-en` skill.
|
||||
@@ -42,7 +42,7 @@ Use this skill for artifact-centric investigation work on ASP.
|
||||
1. If the user asks to find or review artifacts, call `list_artifacts`.
|
||||
2. If the user asks to create a new artifact, call `create_artifact`.
|
||||
3. If the user asks to add an artifact to an alert, first call `create_artifact` when needed or retrieve an existing
|
||||
artifact row ID, then call `attach_artifact_to_alert`.
|
||||
artifact rowid, then call `attach_artifact_to_alert`.
|
||||
4. If the user asks to attach intel, analyst notes, or structured analysis to an artifact, use the `asp-enrichment-en`
|
||||
skill.
|
||||
5. If the user is investigating from an artifact, use the artifact as a pivot and suggest the next useful hop only when
|
||||
@@ -55,7 +55,7 @@ Use this skill for artifact-centric investigation work on ASP.
|
||||
1. Extract the narrowest useful filters from the request.
|
||||
2. Call `list_artifacts`.
|
||||
3. Parse the returned JSON strings.
|
||||
4. Present a compact artifact-oriented view, and surface the artifact row ID when the user is likely to attach or reuse
|
||||
4. Present a compact artifact-oriented view, and surface the artifact rowid when the user is likely to attach or reuse
|
||||
the artifact next.
|
||||
|
||||
Preferred response structure:
|
||||
@@ -69,19 +69,19 @@ Then add one short interpretation line when useful.
|
||||
|
||||
1. Collect the minimum useful artifact information.
|
||||
2. Call `create_artifact`.
|
||||
3. Confirm the created artifact row ID.
|
||||
3. Confirm the created artifact rowid.
|
||||
4. If the artifact should belong to an alert, suggest attaching it next.
|
||||
|
||||
Preferred response structure:
|
||||
|
||||
- `Artifact`: created artifact row ID
|
||||
- `Artifact`: created artifact rowid
|
||||
- `Value`: the main artifact value when useful
|
||||
- `Next useful step`: optional, usually attach it to an alert or enrich it
|
||||
|
||||
### Attach Artifact To Alert
|
||||
|
||||
1. Require `alert_id`.
|
||||
2. If the user does not already have an artifact row ID, either call `create_artifact` for a new artifact or retrieve
|
||||
2. If the user does not already have an artifact rowid, either call `create_artifact` for a new artifact or retrieve
|
||||
the existing artifact first.
|
||||
3. Call `attach_artifact_to_alert(alert_id=<alert_id>, artifact_rowid=<artifact_rowid>)`.
|
||||
4. Confirm that the artifact is attached.
|
||||
|
||||
@@ -46,7 +46,7 @@ artifact 是 ASP 中的三级数据,每个 artifact 都挂载在一个 alert 下
|
||||
1. 从请求中提取最窄且最有用的过滤条件。
|
||||
2. 调用 `list_artifacts`。
|
||||
3. 解析返回的 JSON 字符串。
|
||||
4. 以紧凑的 artifact 视图呈现；如果用户大概率下一步要附加或复用该 artifact，则显式展示 artifact row ID。
|
||||
4. 以紧凑的 artifact 视图呈现；如果用户大概率下一步要附加或复用该 artifact，则显式展示 artifact rowid。
|
||||
|
||||
首选回复结构：
|
||||
|
||||
|
||||
@@ -130,14 +130,14 @@ Preferred response structure:
|
||||
|
||||
1. Require `case_id`.
|
||||
2. Collect the external ticket details the user wants to sync.
|
||||
3. Call `create_ticket` and keep the returned ticket row ID.
|
||||
3. Call `create_ticket` and keep the returned ticket rowid.
|
||||
4. Call `attach_ticket_to_case(case_id=<case_id>, ticket_rowid=<created_rowid>)`.
|
||||
5. Confirm that the ticket was created and attached to the case.
|
||||
|
||||
Preferred response structure:
|
||||
|
||||
- `Case`: case ID
|
||||
- `Ticket`: created ticket row ID or external ticket identifier when useful
|
||||
- `Ticket`: created ticket rowid or external ticket identifier when useful
|
||||
- `Attachment`: attached to case
|
||||
- `Next useful step`: optional, usually to review the case again or update the synced ticket later
|
||||
|
||||
@@ -164,7 +164,7 @@ Good update targets:
|
||||
|
||||
Preferred response structure:
|
||||
|
||||
- `Updated case`: case ID or returned row ID
|
||||
- `Updated case`: case ID or returned rowid
|
||||
- `Changed fields`: only the fields sent in the request
|
||||
- `Next useful step`: optional, usually `list_cases(case_id=..., limit=1)` if the user needs the refreshed record
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ Use this skill when analysis results should be saved back into ASP as structured
|
||||
- Use this skill when the goal is to persist analysis on a `case`, `alert`, or `artifact`.
|
||||
- Separate creation from attachment.
|
||||
- Use `create_enrichment` for a new result record.
|
||||
- Use `attach_enrichment_to_target` only after you have the enrichment row ID.
|
||||
- Use `attach_enrichment_to_target` only after you have the enrichment rowid.
|
||||
- Keep the payload compact and operational.
|
||||
- Prefer object-local skills for reviewing the object itself, and this skill for saving the result.
|
||||
|
||||
@@ -37,7 +37,7 @@ Use this skill when analysis results should be saved back into ASP as structured
|
||||
|
||||
1. If the user wants to save a new structured result, call `create_enrichment` first.
|
||||
2. If the user wants to attach that result to a case, alert, or artifact, call `attach_enrichment_to_target`.
|
||||
3. If the user already has an existing enrichment row ID, skip creation and attach it directly.
|
||||
3. If the user already has an existing enrichment rowid, skip creation and attach it directly.
|
||||
4. If the user is still exploring the object rather than saving a result, use the corresponding object skill first.
|
||||
|
||||
## SOP
|
||||
@@ -46,7 +46,7 @@ Use this skill when analysis results should be saved back into ASP as structured
|
||||
|
||||
1. Require `target_type` and `target_id`.
|
||||
2. Convert the user's analysis into a compact structured enrichment payload.
|
||||
3. Call `create_enrichment` and keep the returned enrichment row ID.
|
||||
3. Call `create_enrichment` and keep the returned enrichment rowid.
|
||||
4. Call
|
||||
`attach_enrichment_to_target(target_type=<target_type>, target_id=<target_id>, enrichment_rowid=<created_rowid>)`.
|
||||
5. Confirm that the enrichment was created and attached.
|
||||
@@ -54,7 +54,7 @@ Use this skill when analysis results should be saved back into ASP as structured
|
||||
Preferred response structure:
|
||||
|
||||
- `Target`: target type and target ID
|
||||
- `Enrichment`: created enrichment row ID
|
||||
- `Enrichment`: created enrichment rowid
|
||||
- `Attachment`: attached to target
|
||||
- `Next useful step`: optional, usually continue investigation, review the enriched object, or run follow-up automation
|
||||
|
||||
@@ -68,7 +68,7 @@ Preferred response structure:
|
||||
## Clarification Rules
|
||||
|
||||
- Ask for `target_type` and `target_id` only when missing.
|
||||
- Ask for the enrichment row ID only when the user wants to reuse an existing enrichment and did not provide it.
|
||||
- Ask for the enrichment rowid only when the user wants to reuse an existing enrichment and did not provide it.
|
||||
- If the user only says "save this result", infer the most obvious target object from the current request when it is
|
||||
clear.
|
||||
- If the user wants a note rather than a structured result, still prefer enrichment when the content is investigative
|
||||
@@ -85,4 +85,4 @@ Preferred response structure:
|
||||
|
||||
- If the target object is missing, say so directly.
|
||||
- If the enrichment payload is incomplete, ask one focused follow-up instead of guessing.
|
||||
- If attachment fails because the enrichment row ID is missing, ask for it or create a new enrichment first.
|
||||
- If attachment fails because the enrichment rowid is missing, ask for it or create a new enrichment first.
|
||||
|
||||
@@ -29,7 +29,7 @@ metadata:
|
||||
- 当目标是把分析结果持久化到 `case`、`alert` 或 `artifact` 上时，使用这个 skill。
|
||||
- 区分“创建 enrichment”和“附加 enrichment”两个动作。
|
||||
- 新结果记录使用 `create_enrichment`。
|
||||
- 只有在已经拿到 enrichment row ID 后，才使用 `attach_enrichment_to_target`。
|
||||
- 只有在已经拿到 enrichment rowid 后，才使用 `attach_enrichment_to_target`。
|
||||
- enrichment payload 保持紧凑且可操作。
|
||||
- 查看对象本身时优先使用对象对应的 skill；保存结果时再使用本 skill。
|
||||
|
||||
@@ -41,7 +41,7 @@ metadata:
|
||||
|
||||
1. 如果用户想保存新的结构化结果，先调用 `create_enrichment`。
|
||||
2. 如果用户想把结果附加到 case、alert 或 artifact，调用 `attach_enrichment_to_target`。
|
||||
3. 如果用户已经有现成的 enrichment row ID，跳过创建，直接附加。
|
||||
3. 如果用户已经有现成的 enrichment rowid，跳过创建，直接附加。
|
||||
4. 如果用户还处于对象探索阶段而不是保存结果，先使用对应对象 skill。
|
||||
|
||||
## SOP
|
||||
@@ -50,16 +50,14 @@ metadata:
|
||||
|
||||
1. 要求提供`target_id` (比如 case_000001 / alert_000001 / artifact_000001)。
|
||||
2. 把用户的分析整理成紧凑的结构化 enrichment payload。
|
||||
3. 调用 `create_enrichment` 并保留返回的 enrichment row ID。
|
||||
3. 调用 `create_enrichment` 并保留返回的 enrichment rowid。
|
||||
4. 调用`attach_enrichment_to_target(target_id=<target_id>, enrichment_rowid=<created_rowid>)`。
|
||||
5. 确认 enrichment 已创建并附加成功。
|
||||
|
||||
首选回复结构：
|
||||
|
||||
- `Target`：目标类型和目标 ID
|
||||
- `Enrichment`：创建出的 enrichment row ID
|
||||
- `Attachment`：已附加到目标
|
||||
- `Next useful step`：可选，通常是继续调查、查看 enrich 后的对象，或继续自动化处理
|
||||
- `Target ID`：目标 ID
|
||||
- `Enrichment`：创建出的 enrichment rowid
|
||||
|
||||
### 附加已有 Enrichment
|
||||
|
||||
@@ -69,10 +67,9 @@ metadata:
|
||||
|
||||
## 澄清规则
|
||||
|
||||
- 只有在缺失时才询问 `target_type` 和 `target_id`。
|
||||
- 只有当用户要复用现有 enrichment 且未提供时，才询问 enrichment row ID。
|
||||
- 如果用户只说“把这个结果保存一下”，在上下文明确时推断最明显的目标对象。
|
||||
- 如果用户要保存的是备注而非严格结构化结果，只要内容本质上是调查上下文，仍优先使用 enrichment。
|
||||
- 只有在缺失时才询问 `target_id`。
|
||||
- 只有当用户要复用现有 enrichment 且未提供时，才询问 enrichment rowid。
|
||||
- 如果用户只说“把这个结果保存一下”，在上下文明确时推断最明显的目标对象,优先选择 Case。
|
||||
|
||||
## 输出规则
|
||||
|
||||
@@ -85,4 +82,4 @@ metadata:
|
||||
|
||||
- 如果目标对象不存在，直接说明。
|
||||
- 如果 enrichment payload 不完整，只问一个聚焦问题，不要猜测。
|
||||
- 如果附加失败是因为缺少 enrichment row ID，就要求用户提供，或先创建新的 enrichment。
|
||||
- 如果附加失败是因为缺少 enrichment rowid，就要求用户提供，或先创建新的 enrichment。
|
||||
|
||||
@@ -70,7 +70,7 @@ Then add one short interpretation line when useful.
|
||||
|
||||
Preferred response structure:
|
||||
|
||||
- `Updated knowledge`: knowledge ID or returned row ID
|
||||
- `Updated knowledge`: knowledge ID or returned rowid
|
||||
- `Changed fields`: only the fields sent in the request
|
||||
- `Next useful step`: optional, usually to query similar knowledge or verify the updated record through a narrowed
|
||||
search
|
||||
|
||||
@@ -97,7 +97,7 @@ ASP 的内部 Knowledge 本质上是一条一条数据库记录，核心字段
|
||||
|
||||
首选回复结构：
|
||||
|
||||
- `Updated knowledge`：knowledge ID 或返回的 row ID
|
||||
- `Updated knowledge`：knowledge ID 或返回的 rowid
|
||||
|
||||
## 澄清规则
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ Use this skill for external ticket sync work on ASP.
|
||||
- Do not ask the user to choose an operation if the request already implies one.
|
||||
- Collect only missing required inputs.
|
||||
- Use `create_ticket` to create the synced ticket record.
|
||||
- Use `attach_ticket_to_case` to link an existing ticket record to a case once you have the ticket row ID.
|
||||
- Use `attach_ticket_to_case` to link an existing ticket record to a case once you have the ticket rowid.
|
||||
- Use `list_tickets` for browsing and lookup.
|
||||
- Use `update_ticket` only for fields the user explicitly wants changed.
|
||||
|
||||
@@ -37,7 +37,7 @@ Use this skill for external ticket sync work on ASP.
|
||||
|
||||
1. If the user wants to create a synced ticket record, call `create_ticket`.
|
||||
2. If the user wants to attach a ticket to a case, first create the ticket when needed or retrieve an existing ticket
|
||||
row ID, then call `attach_ticket_to_case`.
|
||||
rowid, then call `attach_ticket_to_case`.
|
||||
3. If the user wants to browse or compare synced tickets, call `list_tickets`.
|
||||
4. If the user wants to revise synced ticket fields, call `update_ticket`.
|
||||
|
||||
@@ -48,7 +48,7 @@ Use this skill for external ticket sync work on ASP.
|
||||
1. Extract the narrowest useful filters from the request.
|
||||
2. Call `list_tickets`.
|
||||
3. Parse the returned JSON strings.
|
||||
4. Present a compact workflow-oriented view, and surface the ticket row ID when the user is likely to attach or reuse
|
||||
4. Present a compact workflow-oriented view, and surface the ticket rowid when the user is likely to attach or reuse
|
||||
the ticket next.
|
||||
|
||||
Preferred response structure:
|
||||
@@ -62,13 +62,13 @@ Then add one short interpretation line when useful.
|
||||
|
||||
1. Collect the external ticket details the user wants to sync.
|
||||
2. Call `create_ticket`.
|
||||
3. Confirm the created ticket row ID.
|
||||
3. Confirm the created ticket rowid.
|
||||
4. If the ticket should be linked to a case, suggest attaching it next.
|
||||
|
||||
### Attach Ticket To Case
|
||||
|
||||
1. Require `case_id`.
|
||||
2. If the user does not already have a ticket row ID, either call `create_ticket` for a new ticket or retrieve the
|
||||
2. If the user does not already have a ticket rowid, either call `create_ticket` for a new ticket or retrieve the
|
||||
existing ticket first.
|
||||
3. Call `attach_ticket_to_case(case_id=<case_id>, ticket_rowid=<ticket_rowid>)`.
|
||||
4. Confirm that the ticket is attached.
|
||||
@@ -83,7 +83,7 @@ Then add one short interpretation line when useful.
|
||||
|
||||
Preferred response structure:
|
||||
|
||||
- `Updated ticket`: ticket ID or returned row ID
|
||||
- `Updated ticket`: ticket ID or returned rowid
|
||||
- `Changed fields`: only the fields sent in the request
|
||||
- `Next useful step`: optional, usually to attach it to a case or review the refreshed ticket
|
||||
|
||||
|
||||
@@ -29,14 +29,14 @@ metadata:
|
||||
- 如果用户请求已经隐含操作，不要反问用户要哪种操作。
|
||||
- 只收集缺失的必要输入。
|
||||
- 使用 `create_ticket` 创建已同步 ticket 记录。
|
||||
- 使用 `attach_ticket_to_case` 把已有 ticket 记录关联到 case，前提是已经拿到 ticket row ID。
|
||||
- 使用 `attach_ticket_to_case` 把已有 ticket 记录关联到 case，前提是已经拿到 ticket rowid。
|
||||
- 使用 `list_tickets` 浏览和查询。
|
||||
- 使用 `update_ticket` 只修改用户明确要求变更的字段。
|
||||
|
||||
## 决策流程
|
||||
|
||||
1. 如果用户想创建已同步 ticket 记录，调用 `create_ticket`。
|
||||
2. 如果用户想把 ticket 关联到 case，视情况先创建 ticket 或先取回已有 ticket row ID，再调用 `attach_ticket_to_case`。
|
||||
2. 如果用户想把 ticket 关联到 case，视情况先创建 ticket 或先取回已有 ticket rowid，再调用 `attach_ticket_to_case`。
|
||||
3. 如果用户想浏览或对比已同步 ticket，调用 `list_tickets`。
|
||||
4. 如果用户想修改已同步 ticket 字段，调用 `update_ticket`。
|
||||
|
||||
@@ -47,7 +47,7 @@ metadata:
|
||||
1. 从请求中提取最窄且最有用的过滤条件。
|
||||
2. 调用 `list_tickets`。
|
||||
3. 解析返回的 JSON 字符串。
|
||||
4. 以紧凑的工作流视图呈现；如果用户大概率下一步要附加或复用该 ticket，则显式展示 ticket row ID。
|
||||
4. 以紧凑的工作流视图呈现；如果用户大概率下一步要附加或复用该 ticket，则显式展示 ticket rowid。
|
||||
|
||||
首选回复结构：
|
||||
|
||||
@@ -60,13 +60,13 @@ metadata:
|
||||
|
||||
1. 收集用户想同步的外部 ticket 详情。
|
||||
2. 调用 `create_ticket`。
|
||||
3. 确认创建后的 ticket row ID。
|
||||
3. 确认创建后的 ticket rowid。
|
||||
4. 如果该 ticket 应该关联到 case，建议下一步附加到 case。
|
||||
|
||||
### 把 Ticket 附加到 Case
|
||||
|
||||
1. 要求提供 `case_id`。
|
||||
2. 如果用户还没有 ticket row ID，则先为新 ticket 调用 `create_ticket`，或先取回已有 ticket。
|
||||
2. 如果用户还没有 ticket rowid，则先为新 ticket 调用 `create_ticket`，或先取回已有 ticket。
|
||||
3. 调用 `attach_ticket_to_case(case_id=<case_id>, ticket_rowid=<ticket_rowid>)`。
|
||||
4. 确认 ticket 已附加成功。
|
||||
|
||||
@@ -80,7 +80,7 @@ metadata:
|
||||
|
||||
首选回复结构：
|
||||
|
||||
- `Updated ticket`：ticket ID 或返回的 row ID
|
||||
- `Updated ticket`：ticket ID 或返回的 rowid
|
||||
- `Changed fields`：只列本次请求实际提交的字段
|
||||
- `Next useful step`：可选，通常是附加到 case 或查看刷新后的 ticket
|
||||
|
||||
|
||||
Reference in New Issue
Block a user