Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.
A composite skill that orchestrates comprehensive Tier 2/3 investigation of escalated security cases.
CASE_ID - The escalated case to investigate (required)PRIMARY_IOCS - Key IOCs identified during Tier 1 triage (optional)ALERT_TYPE - Type of alert (malware, authentication, network, etc.)ESCALATION_REASON - Why this was escalated from Tier 1┌─────────────────────────────────────────────────────────────────┐
│ FULL INVESTIGATION │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ESCALATED CASE │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /deep-dive-ioc │ (for each primary IOC) │
│ └──────────┬──────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /correlate-ioc │ │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────────────────┐ │
│ │ ALERT TYPE ROUTING │ │
│ └───────────────────────────┘ │
│ │ │
│ ┌─────────┼───────────┬─────────┐ │
│ ▼ ▼ ▼ ▼ │
│ MALWARE AUTH NETWORK OTHER │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ /triage /triage /pivot Continue │
│ -malware -suspicious -on-ioc with pivoting │
│ │ -login │ │ │
│ └─────────┴───────────┴─────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /pivot-on-ioc │ (expand investigation) │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────┴───────┐ │
│ │ DECISION │ │
│ └───────┬───────┘ │
│ │ │
│ ┌─────────┼─────────┐ │
│ ▼ ▼ ▼ │
│ INCIDENT RESOLVED ESCALATE │
│ │ │ TO IR │
│ ▼ ▼ │ │
│ Create /close │ │
│ Incident -case │ │
│ │ -artifact │ │
│ │ │ │ │
│ └─────────┴─────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────┐ │
│ │ /generate-report │ │
│ └──────────┬──────────┘ │
│ │ │
│ ▼ │
│ END │
│ │
└─────────────────────────────────────────────────────────────────┘
Step 1.0: Extract Primary IOCs (if not provided)
If PRIMARY_IOCS is not provided as input, extract key entities from the case:
secops-soar.get_case_full_details(case_id=CASE_ID)
From the case details, extract IOCs:
Populate PRIMARY_IOCS with extracted IOCs.
Step 1.1: Deep Dive on Primary IOCs
For each IOC in PRIMARY_IOCS:
Invoke: /deep-dive-ioc IOC_VALUE=$ioc CASE_ID=$CASE_ID
Collect:
GTI_DEEP_FINDINGS - Full threat intelligence analysisSIEM_DEEP_CONTEXT - Detailed SIEM contextRELATED_ENTITIES - Discovered related IOCs and entitiesTHREAT_ATTRIBUTION - Any threat actor/campaign linksStep 1.2: Aggregate Discovered IOCs
Combine all RELATED_ENTITIES collected from deep-dive steps into ALL_DISCOVERED_IOCS:
ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(RELATED_ENTITIES from each deep-dive)
This aggregated list is used for correlation in Phase 2.
Step 2.1: Correlate with Existing Cases
Invoke: /correlate-ioc IOC_LIST=$ALL_DISCOVERED_IOCS
Collect:
RELATED_CASES - Other cases with same IOCsRELATED_ALERTS - Alerts involving same entitiesPATTERN_ANALYSIS - Detected patterns across casesStep 2.2: Find Related Open Cases
Invoke: /find-relevant-case with key entities
Document any linked investigations.
Step 3.1: Route by Alert Type
Based on ALERT_TYPE, invoke specialized triage:
| Alert Type | Skill | Focus |
|---|---|---|
| Malware | /triage-malware | File analysis, behavior, persistence |
| Authentication | /triage-suspicious-login | User activity, login patterns |
| Network | /pivot-on-ioc | Network IOC relationships |
| Other | Continue to pivoting | General IOC expansion |
For Malware:
Invoke: /triage-malware FILE_HASH=$hash CASE_ID=$CASE_ID
Collect:
For Authentication:
Invoke: /triage-suspicious-login USER=$user CASE_ID=$CASE_ID
Collect:
Step 4.1: Pivot on High-Confidence IOCs
For each high-confidence malicious IOC:
Invoke: /pivot-on-ioc IOC_VALUE=$ioc
Collect:
RELATED_INFRASTRUCTURE - Connected domains, IPs, filesCAMPAIGN_LINKS - Associated campaigns or actorsADDITIONAL_IOCS - New IOCs to hunt forStep 4.2: Validate Expanded IOCs
For significant new IOCs discovered:
Step 5.1: Determine Investigation Outcome
Assess all findings and classify:
| Outcome | Criteria | Action |
|---|---|---|
| Incident Confirmed | Active compromise, ongoing threat | Escalate to IR |
| Resolved - Contained | Threat neutralized, no ongoing risk | Document & Close |
| Resolved - False Positive | Deep analysis confirms benign | Document & Close |
| Requires IR Escalation | Containment/eradication needed | Escalate to IR |
Step 5.2: Execute Disposition
If Incident Confirmed / Requires IR:
/document-in-case with full findings/respond-ransomware/respond-malware/respond-phishing/respond-compromised-accountIf Resolved:
/document-in-case with:
/close-case-artifact with appropriate reasonStep 6.1: Generate Investigation Report
Invoke: /generate-report REPORT_TYPE=investigation
Include:
| Output | Description |
|---|---|
INVESTIGATION_OUTCOME | Incident, Resolved, or Escalated |
THREAT_ASSESSMENT | Severity, scope, and attribution |
ALL_IOCS | Complete list of analyzed IOCs with verdicts |
ATTACK_CHAIN | Reconstructed attack timeline (if applicable) |
REPORT_PATH | Path to investigation report |
ESCALATION_DETAILS | If escalated, target and handoff package |
/deep-dive-ioc fails → Fall back to /enrich-ioc, continue