From asp
Manages ASP security cases: review by ID, list with filters, inspect discussions/alerts/playbooks, update workflow/AI fields, run playbooks.
How this skill is triggered — by the user, by Claude, or both
Slash command
/asp:asp-case-enThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill for case-centric SOC work on ASP.
Use this skill for case-centric SOC work on ASP.
list_cases(case_id=...) because the current MCP surface does not expose a separate
get_case tool.asp-enrichment-en skill.list_cases
with case_id and limit=1.get_case_discussions after retrieving the case.correlation_uid and call list_alerts when that
helps answer the case question.list_playbook_runs(source_id=case_id, type=[CASE]).list_available_playbook_definitions only when the playbook
name is missing, then call execute_playbook(type=CASE, record_id=case_id, name=...).asp-enrichment-en skill.create_ticket, then call
attach_ticket_to_case(case_id=<case_id>, ticket_rowid=<created_rowid>).list_cases.update_case.list_cases(case_id=<id>, limit=1).get_case_discussions(case_id).correlation_uid and the user needs related alert context, use it as a pivot and call
list_alerts(correlation_uid=...).list_playbook_runs(source_id=case_id, type=[CASE]).Preferred response structure:
Case: case ID, title, severity, status, verdict, confidence, priority, category.Timeline: created, acknowledged, closed, calculated start/end if present.Key Alerts: only the most relevant alerts, not every alert by default.Discussions: only the key analyst or system discussion points when relevant.Playbook Runs: only current or recent runs when relevant.Analyst / AI Notes: comment, summary, AI fields when relevant.Use concise incident-review language. Prefer a short analytical summary before structured details when the user asks for "what happened" or "help me understand this case".
case_id, status, severity, confidence, verdict, correlation_uid, title,
tags, limit.list_cases.Preferred response structure:
| Case ID | Title | Severity | Status | Verdict | Confidence | Priority | Updated |
|---|
Then add one short line of interpretation when useful, for example:
case_id.list_available_playbook_definitions and suggest the most
relevant options instead of guessing.execute_playbook(type=CASE, record_id=case_id, name=<definition_name>, user_input=<optional>).list_playbook_runs(source_id=case_id, type=[CASE]).Preferred response structure:
Case: case IDPlaybook: definition nameRun status: usually pending at creation timeUser input: only if providedNext useful step: optional, usually to query case-related runscase_id.create_ticket and keep the returned ticket row ID.attach_ticket_to_case(case_id=<case_id>, ticket_rowid=<created_rowid>).Preferred response structure:
Case: case IDTicket: created ticket row ID or external ticket identifier when usefulAttachment: attached to caseNext useful step: optional, usually to review the case again or update the synced ticket latercase_id.update_case with only changed fields.None, state that the case was not found.Good update targets:
severitystatusverdictseverity_aiconfidence_aiattack_stage_aicomment_aisummary_aiPreferred response structure:
Updated case: case ID or returned row IDChanged fields: only the fields sent in the requestNext useful step: optional, usually list_cases(case_id=..., limit=1) if the user needs the refreshed recordcase_id only when missing.list_cases instead of forcing
them to choose an operation.npx claudepluginhub funnywolf/agentic-soc-platform --plugin ASPManages ASP security cases: reviews details/discussions/alerts, lists by status/severity/confidence/verdict/tags/filters, updates workflows/AI fields, attaches external tickets/enrichments.
Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Agent-delegated architecture: Haiku for mechanical tasks, Sonnet for substantive work, Opus for judgment.
Manages Checkpoint Harmony Email (Avanan) security incident workflows: lifecycle, status transitions, triage, investigation, escalation, remediation, and closure.