Cyber Analysis

Cyber Analysis turns raw security detections into structured, customer-ready incident write-ups in a Senior SOC Analyst voice — without the hallucinated facts that make most LLM-based alert triage unusable.

Built for MDR providers, in-house SOC teams, and OpenClaw agents running automated L1/L2 triage with human escalation. Deployed across three client SOCs where it has replaced hours of analyst write-up time per shift while keeping the quality high enough to send directly to end customers.

The skill works on Microsoft Defender, Cortex XDR, Sentinel, CrowdStrike, SentinelOne, and Splunk inputs, plus loose IOCs (hashes, IPs, URLs, domains). It produces a full incident write-up, a 4–6 sentence summary, or a one-line disposition depending on what the workflow needs — ideal for agents that escalate structured output to a human analyst only when confidence is low.

Every external artifact gets automatically enriched via VirusTotal, AbuseIPDB, IBM X-Force, URLScan, and GreyNoise, with verdicts reported verbatim — never invented. An 11-category forbidden-claims list blocks the usual LLM failure modes: fabricated VT scores, attribution guesses, malicious-by-assumption calls, and single-vendor-hit escalations.

Built on a four-step workflow — platform detection → Evidence Ledger (known vs unknown) → OSINT enrichment → confidence tagging — that prevents the model from filling in fields it wasn't given. This is the difference between a skill your team actually trusts in front of customers and one that needs a human to re-check every output.

Works in Claude.ai, Claude Code, and OpenClaw — same SKILL.md, no conversion.