rl-soc

Plugin rl-soc from marketplace rl-spectra-ai-soc in reversinglabs/rl-spectra-ai-soc. Commands read from the repo's manifest — 1 month ago.

Skills (8)

• full

  Full SOC threat-analysis pipeline. Give it a file, hash, URL, IP, or domain and it runs all phases in sequence: triage → FP validation → investigation → adjudication → remediation (if TP) → reporting. Triggers on "analyze this hash", "investigate this URL", "is this malware", "run threat analysis on

• rl-adjudicate

  SOC adjudication phase. Reads FP validation findings and investigation findings, spawns the rl-adjudicate agent to weigh all evidence and produce a final CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with confidence and a full per-signal audit trail. Gates transition to remediation. Writes rl-adju

• rl-fp-validate

  False positive validation phase. Reads rl-triage-handoff.md and evaluates multiple FP signals to determine whether the detection is likely a false positive. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation. Writes rl-fp-validate-findings.md. Trigger

• rl-investigate

  SOC investigation phase. Reads rl-triage-handoff.md and performs deep enrichment by spawning three parallel sub-agents: IOC enrichment, sample pivots, and YARA hunting with sandbox polling. Writes rl-investigate-findings.md. Trigger when triage and FP validation are complete and a full investigation

• rl-remediate

  SOC remediation phase. Reads triage, investigation, and adjudication findings and produces a prioritized containment and eradication playbook. Writes rl-remediate-playbook.md. Only runs when adjudication verdict is CONFIRMED TP or UNCERTAIN. Trigger after adjudication, or as part of the rl-soc pipel

• rl-report

  SOC reporting phase. Reads all prior phase handoff files and synthesizes them into a narrative Markdown incident report and a machine-readable JSON IOC file. Trigger after all analysis phases are complete, or as part of the rl-soc pipeline.

• rl-triage

  SOC triage phase. Takes a suspicious file, hash, URL, IP, or domain and produces an initial classification using ReversingLabs Spectra Intelligence. For file and hash artifacts, spawns three parallel sub-agents: classification, sandbox orchestration, and content inspection (Text/* types). For networ

• verdict

  Verdict-only SOC pipeline. Runs Phases 1–4: triage, FP validation, investigation, and adjudication. Produces a CONFIRMED TP / CONFIRMED FP / UNCERTAIN verdict with a full audit trail. No remediation playbook or incident report. Use when you want a verdict without the full output. Triggers on "is thi

Subagents (10)

• rl-adjudicate

  SOC adjudication agent. Weighs FP validation findings against investigation findings to produce a final TP/FP verdict with confidence and a full per-signal audit trail. Gates the transition from investigation to remediation.

• rl-fp-validate

  False positive validation agent. Reads triage classification results and evaluates multiple FP signals to produce an FP confidence score and recommendation. A CONCLUSIVE FP recommendation short-circuits the pipeline, skipping investigation and remediation.

• rl-investigate-enrich

  Investigation enrichment sub-agent. Takes all IOCs from the triage handoff and performs bulk reputation lookups for file hashes and network indicators. Flags any classification changes since triage. Runs in parallel with rl-investigate-pivot and rl-investigate-hunt.

• rl-investigate-hunt

  Investigation hunting sub-agent. Runs a YARA retrohunt across the Spectra corpus and polls any in-flight dynamic/auxiliary sandbox analyses started during triage. Runs in parallel with rl-investigate-enrich and rl-investigate-pivot.

• rl-investigate-pivot

  Investigation pivot sub-agent. Performs advanced search pivots to find related samples (same threat name, signer, C2, imphash), similarity analytics for executable samples, and certificate analytics if the sample is signed. Runs in parallel with rl-investigate-enrich and rl-investigate-hunt.

• rl-remediate

  SOC remediation specialist. Takes triage + investigation findings and produces containment and eradication INSTRUCTIONS for IT/IR teams to execute. This agent does NOT perform any remediation actions — it generates a copy-pasteable playbook only.

• rl-report

  SOC incident reporting agent. Takes all prior phase outputs (triage, investigation, remediation) and synthesizes them into a final incident report. Produces TWO artifacts: a Markdown narrative report and a machine-readable JSON IOC file for SOAR / TIP ingestion.

• rl-triage-classify

  SOC triage classification sub-agent. Identifies the artifact type (file, hash, URL, IP, or domain), submits files if needed, retrieves Spectra Intelligence classification, indicators, TTPs, and detection rules. Runs in parallel with rl-triage-sandbox.

• rl-triage-inspect

  Content analysis sub-agent. Retrieves and semantically analyzes the raw content of text-based samples (Text/* Spectra file types) to identify hostile code patterns, obfuscation, and evasion techniques. Produces a structured signal table and a CONCLUSIVE BENIGN / CONCLUSIVE MALICIOUS / INCONCLUSIVE v

• rl-triage-sandbox

  SOC triage sandbox sub-agent. Checks whether dynamic and auxiliary analyses exist for a sample; starts them if not. Records in-flight analysis IDs for the investigation phase to poll. Runs in parallel with rl-triage-classify.

Similar plugins