npx claudepluginhub funnywolf/agentic-soc-platform --plugin ASPThis skill uses the workspace's default tool permissions.
Use this skill for artifact-centric investigation work on ASP.
Queries ASP cyber security artifacts by IOC, value, type, role, owner, or reputation for investigations, pivoting, and enrichment attachment.
Guides use of SentinelOne Purple AI for natural language cybersecurity investigations, threat hunting, behavioral anomaly analysis, MITRE ATT&CK TTP mapping, and PowerQuery generation via purple_ai tool.
Triages Elastic Security alerts: fetches next alert, runs context queries, classifies threats, creates cases, and acknowledges. For SOC analysis and detections.
Share bugs, ideas, or general feedback.
Use this skill for artifact-centric investigation work on ASP.
list_artifacts for lookup and review.create_artifact when the user wants to add a new artifact record.attach_artifact_to_alert only after you already have an artifact row ID.create_enrichment plus attach_enrichment_to_target when the user wants to save analysis on the artifact
itself.asp-enrichment-en skill.list_artifacts.create_artifact.create_artifact when needed or retrieve an existing
artifact row ID, then call attach_artifact_to_alert.asp-enrichment-en
skill.list_artifacts.Preferred response structure:
| Artifact ID | Value | Type | Role | Owner | Reputation | Summary |
|---|
Then add one short interpretation line when useful.
create_artifact.Preferred response structure:
Artifact: created artifact row IDValue: the main artifact value when usefulNext useful step: optional, usually attach it to an alert or enrich italert_id.create_artifact for a new artifact or retrieve
the existing artifact first.attach_artifact_to_alert(alert_id=<alert_id>, artifact_rowid=<artifact_rowid>).alert_id only when the user wants alert attachment and did not provide it.artifact_id only when the user wants to enrich an existing artifact and did not provide it.