[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-stage-1-triage":3,"mdc--5uyl5d-key":36,"related-org-aws-labs-stage-1-triage":3211,"related-repo-aws-labs-stage-1-triage":3390},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":34,"mdContent":35},"stage-1-triage","perform initial malware sample triage","Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Triage","triage",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",{"name":24,"slug":25,"type":16},"Debugging","debugging",1,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform","2026-08-04T05:58:50.852669",null,0,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":29},[],"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform\u002Ftree\u002FHEAD\u002Fmodules\u002Fdomain-apps\u002Fcyber\u002Fagent\u002Fskills\u002Fstage-1-triage","---\nname: stage-1-triage\ndescription: Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).\n---\n\n# Stage 1 — Triage\n\nYou run in the main ADP cluster; sample bytes live in S3. You never download them — the sandboxed triage worker does. Send a message, poll for the response, parse the result.\n\nIf a Stage 1 envelope for this artifact already exists in DDB (re-run scenario), read the cached one instead of re-queueing.\n\n## Inputs\n\n| Var | Source | Shape |\n|---|---|---|\n| `ARTIFACT_ID` | issue body | string, stable across stages |\n| `SAMPLE_S3_URI` | issue body | `s3:\u002F\u002Fbucket\u002Fkey` pointing at raw sample |\n| `CYBER_TRIAGE_QUEUE` | env | FIFO queue URL |\n| `CYBER_TRIAGE_RESPONSE_QUEUE` | env | FIFO response queue URL |\n| `CYBER_RESULTS_TABLE` | env | DDB table name |\n\n## Outputs\n\nStage envelope (same shape for every stage):\n\n```json\n{\n  \"artifact_id\": \"\u003CARTIFACT_ID>\",\n  \"stage\": 1,\n  \"stage_name\": \"triage\",\n  \"timestamp\": \"\u003CISO8601 UTC>\",\n  \"status\": \"ok | partial | failed\",\n  \"duration_seconds\": \u003Cint>,\n  \"findings\": {\n    \"hashes\": {\"md5\": \"...\", \"sha1\": \"...\", \"sha256\": \"...\"},\n    \"file_type\": \"\u003Cfrom `file` command>\",\n    \"file_type_magika\": \"\u003Cfrom magika>\",\n    \"file_type_disagreement\": true|false,\n    \"compile_timestamp\": \"\u003CISO8601 or null>\",\n    \"signature_status\": \"valid | invalid | unsigned | unknown\",\n    \"sections\": [{\"name\": \"...\", \"entropy\": 7.23, \"packed_flag\": true}],\n    \"strings_sample\": [\"...\", \"...\"],\n    \"candidate_iocs\": {\n      \"domains\": [],\n      \"ips\": [],\n      \"urls\": [],\n      \"registry_paths\": [],\n      \"mutexes\": []\n    }\n  },\n  \"tool_calls\": \u003Cint>,\n  \"notes\": \"free text\"\n}\n```\n\n## Steps\n\n### 1. Check DDB for cached result\n\n```bash\naws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a AND begins_with(stage_timestamp, :s)\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"},\":s\":{\"S\":\"triage#\"}}' \\\n  --query 'Items[0]' --output json\n```\n\nIf a row exists and is recent (\u003C 7 days), reuse it — skip to step 4.\n\n### 2. Send to triage queue\n\n```bash\nMSG_ID=$(aws sqs send-message --region us-east-1 \\\n  --queue-url \"$CYBER_TRIAGE_QUEUE\" \\\n  --message-group-id \"$ARTIFACT_ID\" \\\n  --message-deduplication-id \"${ARTIFACT_ID}-triage-$(date +%s)\" \\\n  --message-body \"{\\\"artifact_id\\\":\\\"$ARTIFACT_ID\\\",\\\"sample_s3_uri\\\":\\\"$SAMPLE_S3_URI\\\",\\\"stage\\\":\\\"triage\\\"}\" \\\n  --query 'MessageId' --output text)\necho \"Enqueued triage: $MSG_ID\"\n```\n\n### 3. Poll the response queue\n\n```bash\n# Poll up to 3 minutes (triage is fast)\nfor i in $(seq 1 36); do\n  RESP=$(aws sqs receive-message --region us-east-1 \\\n    --queue-url \"$CYBER_TRIAGE_RESPONSE_QUEUE\" \\\n    --max-number-of-messages 1 \\\n    --wait-time-seconds 5 \\\n    --visibility-timeout 10 \\\n    --query 'Messages[0]' --output json)\n\n  if [ \"$RESP\" != \"null\" ] && [ -n \"$RESP\" ]; then\n    BODY=$(echo \"$RESP\" | jq -r '.Body')\n    RECEIPT=$(echo \"$RESP\" | jq -r '.ReceiptHandle')\n    # Check it's for our artifact\n    if echo \"$BODY\" | jq -e --arg a \"$ARTIFACT_ID\" '.artifact_id == $a' > \u002Fdev\u002Fnull; then\n      aws sqs delete-message --region us-east-1 \\\n        --queue-url \"$CYBER_TRIAGE_RESPONSE_QUEUE\" \\\n        --receipt-handle \"$RECEIPT\"\n      echo \"$BODY\"\n      break\n    fi\n  fi\n  sleep 5\ndone\n```\n\nIf no response in 3 min, fail the stage with `status: \"failed\"` + `notes: \"triage worker did not respond\"`. Don't block the pipeline — move to Stage 2 with the fingerprint fields set to `null`.\n\n### 4. Write envelope to DDB\n\n```bash\nTS=$(date -u +%s)\naws dynamodb put-item --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --item \"$(jq -n --arg a \"$ARTIFACT_ID\" --arg sk \"triage#$TS\" --argjson findings \"$BODY\" \\\n    '{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"triage\"}, status:{S:\"ok\"}, findings:{S:($findings|tostring)}}')\"\n```\n\n### 5. Post stage comment to the issue\n\nUse the `issue-comment` skill (or invoke `gh issue comment` directly) with:\n\n```markdown\n## Stage 1 — Triage\n\n**Status**: ✅ complete | ⚠️ partial | ❌ failed\n\n| Hash | Value |\n|------|-------|\n| MD5 | `\u003Cmd5>` |\n| SHA1 | `\u003Csha1>` |\n| SHA256 | `\u003Csha256>` |\n\n- **File type (file)**: ...\n- **File type (magika)**: ...\n- **Disagreement?**: yes\u002Fno — _if yes, flag it as a signal_\n- **Compile timestamp**: ...\n- **Signature**: valid \u002F unsigned \u002F invalid\n- **High-entropy sections** (>7.0): ...\n\n**Candidate IOCs** (for Stage 2):\n- Domains: ...\n- IPs: ...\n- URLs: ...\n\n\u003Cdetails>\u003Csummary>Full JSON\u003C\u002Fsummary>\n\n```json\n{...full envelope...}\n```\n\u003C\u002Fdetails>\n```\n\n## Failure handling\n\n- Queue send fails → retry 3× with 5s backoff, then fail the stage\n- No response in 3 min → mark stage `failed`, proceed to Stage 2 with null fingerprint\n- DDB write fails → retry 3×, then write envelope to S3 at `s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\u002Fstage-1-triage.json` as fallback\n- GH comment fails → retry 3×, then continue (don't block pipeline on comment failures)\n\n## Guardrails\n\n- The sandboxed worker handles sample bytes; your skill only passes an S3 URI over SQS. Keeping bytes out of this pod is what preserves the blast-radius boundary between the main cluster and the Threat Research VPC.\n- Publish the stage comment before moving to Stage 2. Users watch these comments stream in as the pipeline runs; a skipped comment looks like a stall.\n- Reuse cached envelopes when `artifact_id` was seen recently. Re-queueing wastes worker time and produces duplicate DDB rows that Stage 7's report assembly then has to deduplicate.\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,49,55,60,67,214,220,225,1221,1227,1234,1404,1409,1415,1731,1737,2397,2425,2431,2615,2621,2642,3127,3133,3174,3180,3205],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Stage 1 — Triage",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53],{"type":47,"value":54},"You run in the main ADP cluster; sample bytes live in S3. You never download them — the sandboxed triage worker does. Send a message, poll for the response, parse the result.",{"type":42,"tag":50,"props":56,"children":57},{},[58],{"type":47,"value":59},"If a Stage 1 envelope for this artifact already exists in DDB (re-run scenario), read the cached one instead of re-queueing.",{"type":42,"tag":61,"props":62,"children":64},"h2",{"id":63},"inputs",[65],{"type":47,"value":66},"Inputs",{"type":42,"tag":68,"props":69,"children":70},"table",{},[71,95],{"type":42,"tag":72,"props":73,"children":74},"thead",{},[75],{"type":42,"tag":76,"props":77,"children":78},"tr",{},[79,85,90],{"type":42,"tag":80,"props":81,"children":82},"th",{},[83],{"type":47,"value":84},"Var",{"type":42,"tag":80,"props":86,"children":87},{},[88],{"type":47,"value":89},"Source",{"type":42,"tag":80,"props":91,"children":92},{},[93],{"type":47,"value":94},"Shape",{"type":42,"tag":96,"props":97,"children":98},"tbody",{},[99,123,150,172,193],{"type":42,"tag":76,"props":100,"children":101},{},[102,113,118],{"type":42,"tag":103,"props":104,"children":105},"td",{},[106],{"type":42,"tag":107,"props":108,"children":110},"code",{"className":109},[],[111],{"type":47,"value":112},"ARTIFACT_ID",{"type":42,"tag":103,"props":114,"children":115},{},[116],{"type":47,"value":117},"issue body",{"type":42,"tag":103,"props":119,"children":120},{},[121],{"type":47,"value":122},"string, stable across stages",{"type":42,"tag":76,"props":124,"children":125},{},[126,135,139],{"type":42,"tag":103,"props":127,"children":128},{},[129],{"type":42,"tag":107,"props":130,"children":132},{"className":131},[],[133],{"type":47,"value":134},"SAMPLE_S3_URI",{"type":42,"tag":103,"props":136,"children":137},{},[138],{"type":47,"value":117},{"type":42,"tag":103,"props":140,"children":141},{},[142,148],{"type":42,"tag":107,"props":143,"children":145},{"className":144},[],[146],{"type":47,"value":147},"s3:\u002F\u002Fbucket\u002Fkey",{"type":47,"value":149}," pointing at raw sample",{"type":42,"tag":76,"props":151,"children":152},{},[153,162,167],{"type":42,"tag":103,"props":154,"children":155},{},[156],{"type":42,"tag":107,"props":157,"children":159},{"className":158},[],[160],{"type":47,"value":161},"CYBER_TRIAGE_QUEUE",{"type":42,"tag":103,"props":163,"children":164},{},[165],{"type":47,"value":166},"env",{"type":42,"tag":103,"props":168,"children":169},{},[170],{"type":47,"value":171},"FIFO queue URL",{"type":42,"tag":76,"props":173,"children":174},{},[175,184,188],{"type":42,"tag":103,"props":176,"children":177},{},[178],{"type":42,"tag":107,"props":179,"children":181},{"className":180},[],[182],{"type":47,"value":183},"CYBER_TRIAGE_RESPONSE_QUEUE",{"type":42,"tag":103,"props":185,"children":186},{},[187],{"type":47,"value":166},{"type":42,"tag":103,"props":189,"children":190},{},[191],{"type":47,"value":192},"FIFO response queue URL",{"type":42,"tag":76,"props":194,"children":195},{},[196,205,209],{"type":42,"tag":103,"props":197,"children":198},{},[199],{"type":42,"tag":107,"props":200,"children":202},{"className":201},[],[203],{"type":47,"value":204},"CYBER_RESULTS_TABLE",{"type":42,"tag":103,"props":206,"children":207},{},[208],{"type":47,"value":166},{"type":42,"tag":103,"props":210,"children":211},{},[212],{"type":47,"value":213},"DDB table name",{"type":42,"tag":61,"props":215,"children":217},{"id":216},"outputs",[218],{"type":47,"value":219},"Outputs",{"type":42,"tag":50,"props":221,"children":222},{},[223],{"type":47,"value":224},"Stage envelope (same shape for every stage):",{"type":42,"tag":226,"props":227,"children":232},"pre",{"className":228,"code":229,"language":230,"meta":231,"style":231},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"artifact_id\": \"\u003CARTIFACT_ID>\",\n  \"stage\": 1,\n  \"stage_name\": \"triage\",\n  \"timestamp\": \"\u003CISO8601 UTC>\",\n  \"status\": \"ok | partial | failed\",\n  \"duration_seconds\": \u003Cint>,\n  \"findings\": {\n    \"hashes\": {\"md5\": \"...\", \"sha1\": \"...\", \"sha256\": \"...\"},\n    \"file_type\": \"\u003Cfrom `file` command>\",\n    \"file_type_magika\": \"\u003Cfrom magika>\",\n    \"file_type_disagreement\": true|false,\n    \"compile_timestamp\": \"\u003CISO8601 or null>\",\n    \"signature_status\": \"valid | invalid | unsigned | unknown\",\n    \"sections\": [{\"name\": \"...\", \"entropy\": 7.23, \"packed_flag\": true}],\n    \"strings_sample\": [\"...\", \"...\"],\n    \"candidate_iocs\": {\n      \"domains\": [],\n      \"ips\": [],\n      \"urls\": [],\n      \"registry_paths\": [],\n      \"mutexes\": []\n    }\n  },\n  \"tool_calls\": \u003Cint>,\n  \"notes\": \"free text\"\n}\n","json","",[233],{"type":42,"tag":107,"props":234,"children":235},{"__ignoreMap":231},[236,247,292,323,360,398,436,467,493,623,661,699,735,773,811,918,977,1002,1029,1054,1079,1104,1130,1139,1148,1177,1212],{"type":42,"tag":237,"props":238,"children":240},"span",{"class":239,"line":26},"line",[241],{"type":42,"tag":237,"props":242,"children":244},{"style":243},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[245],{"type":47,"value":246},"{\n",{"type":42,"tag":237,"props":248,"children":250},{"class":239,"line":249},2,[251,256,262,267,272,277,283,287],{"type":42,"tag":237,"props":252,"children":253},{"style":243},[254],{"type":47,"value":255},"  \"",{"type":42,"tag":237,"props":257,"children":259},{"style":258},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[260],{"type":47,"value":261},"artifact_id",{"type":42,"tag":237,"props":263,"children":264},{"style":243},[265],{"type":47,"value":266},"\"",{"type":42,"tag":237,"props":268,"children":269},{"style":243},[270],{"type":47,"value":271},":",{"type":42,"tag":237,"props":273,"children":274},{"style":243},[275],{"type":47,"value":276}," \"",{"type":42,"tag":237,"props":278,"children":280},{"style":279},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[281],{"type":47,"value":282},"\u003CARTIFACT_ID>",{"type":42,"tag":237,"props":284,"children":285},{"style":243},[286],{"type":47,"value":266},{"type":42,"tag":237,"props":288,"children":289},{"style":243},[290],{"type":47,"value":291},",\n",{"type":42,"tag":237,"props":293,"children":295},{"class":239,"line":294},3,[296,300,305,309,313,319],{"type":42,"tag":237,"props":297,"children":298},{"style":243},[299],{"type":47,"value":255},{"type":42,"tag":237,"props":301,"children":302},{"style":258},[303],{"type":47,"value":304},"stage",{"type":42,"tag":237,"props":306,"children":307},{"style":243},[308],{"type":47,"value":266},{"type":42,"tag":237,"props":310,"children":311},{"style":243},[312],{"type":47,"value":271},{"type":42,"tag":237,"props":314,"children":316},{"style":315},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[317],{"type":47,"value":318}," 1",{"type":42,"tag":237,"props":320,"children":321},{"style":243},[322],{"type":47,"value":291},{"type":42,"tag":237,"props":324,"children":326},{"class":239,"line":325},4,[327,331,336,340,344,348,352,356],{"type":42,"tag":237,"props":328,"children":329},{"style":243},[330],{"type":47,"value":255},{"type":42,"tag":237,"props":332,"children":333},{"style":258},[334],{"type":47,"value":335},"stage_name",{"type":42,"tag":237,"props":337,"children":338},{"style":243},[339],{"type":47,"value":266},{"type":42,"tag":237,"props":341,"children":342},{"style":243},[343],{"type":47,"value":271},{"type":42,"tag":237,"props":345,"children":346},{"style":243},[347],{"type":47,"value":276},{"type":42,"tag":237,"props":349,"children":350},{"style":279},[351],{"type":47,"value":19},{"type":42,"tag":237,"props":353,"children":354},{"style":243},[355],{"type":47,"value":266},{"type":42,"tag":237,"props":357,"children":358},{"style":243},[359],{"type":47,"value":291},{"type":42,"tag":237,"props":361,"children":363},{"class":239,"line":362},5,[364,368,373,377,381,385,390,394],{"type":42,"tag":237,"props":365,"children":366},{"style":243},[367],{"type":47,"value":255},{"type":42,"tag":237,"props":369,"children":370},{"style":258},[371],{"type":47,"value":372},"timestamp",{"type":42,"tag":237,"props":374,"children":375},{"style":243},[376],{"type":47,"value":266},{"type":42,"tag":237,"props":378,"children":379},{"style":243},[380],{"type":47,"value":271},{"type":42,"tag":237,"props":382,"children":383},{"style":243},[384],{"type":47,"value":276},{"type":42,"tag":237,"props":386,"children":387},{"style":279},[388],{"type":47,"value":389},"\u003CISO8601 UTC>",{"type":42,"tag":237,"props":391,"children":392},{"style":243},[393],{"type":47,"value":266},{"type":42,"tag":237,"props":395,"children":396},{"style":243},[397],{"type":47,"value":291},{"type":42,"tag":237,"props":399,"children":401},{"class":239,"line":400},6,[402,406,411,415,419,423,428,432],{"type":42,"tag":237,"props":403,"children":404},{"style":243},[405],{"type":47,"value":255},{"type":42,"tag":237,"props":407,"children":408},{"style":258},[409],{"type":47,"value":410},"status",{"type":42,"tag":237,"props":412,"children":413},{"style":243},[414],{"type":47,"value":266},{"type":42,"tag":237,"props":416,"children":417},{"style":243},[418],{"type":47,"value":271},{"type":42,"tag":237,"props":420,"children":421},{"style":243},[422],{"type":47,"value":276},{"type":42,"tag":237,"props":424,"children":425},{"style":279},[426],{"type":47,"value":427},"ok | partial | failed",{"type":42,"tag":237,"props":429,"children":430},{"style":243},[431],{"type":47,"value":266},{"type":42,"tag":237,"props":433,"children":434},{"style":243},[435],{"type":47,"value":291},{"type":42,"tag":237,"props":437,"children":439},{"class":239,"line":438},7,[440,444,449,453,457,463],{"type":42,"tag":237,"props":441,"children":442},{"style":243},[443],{"type":47,"value":255},{"type":42,"tag":237,"props":445,"children":446},{"style":258},[447],{"type":47,"value":448},"duration_seconds",{"type":42,"tag":237,"props":450,"children":451},{"style":243},[452],{"type":47,"value":266},{"type":42,"tag":237,"props":454,"children":455},{"style":243},[456],{"type":47,"value":271},{"type":42,"tag":237,"props":458,"children":460},{"style":459},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[461],{"type":47,"value":462}," \u003Cint>",{"type":42,"tag":237,"props":464,"children":465},{"style":243},[466],{"type":47,"value":291},{"type":42,"tag":237,"props":468,"children":470},{"class":239,"line":469},8,[471,475,480,484,488],{"type":42,"tag":237,"props":472,"children":473},{"style":243},[474],{"type":47,"value":255},{"type":42,"tag":237,"props":476,"children":477},{"style":258},[478],{"type":47,"value":479},"findings",{"type":42,"tag":237,"props":481,"children":482},{"style":243},[483],{"type":47,"value":266},{"type":42,"tag":237,"props":485,"children":486},{"style":243},[487],{"type":47,"value":271},{"type":42,"tag":237,"props":489,"children":490},{"style":243},[491],{"type":47,"value":492}," {\n",{"type":42,"tag":237,"props":494,"children":496},{"class":239,"line":495},9,[497,502,508,512,516,521,525,530,534,538,542,547,551,556,560,565,569,573,577,581,585,589,593,598,602,606,610,614,618],{"type":42,"tag":237,"props":498,"children":499},{"style":243},[500],{"type":47,"value":501},"    \"",{"type":42,"tag":237,"props":503,"children":505},{"style":504},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[506],{"type":47,"value":507},"hashes",{"type":42,"tag":237,"props":509,"children":510},{"style":243},[511],{"type":47,"value":266},{"type":42,"tag":237,"props":513,"children":514},{"style":243},[515],{"type":47,"value":271},{"type":42,"tag":237,"props":517,"children":518},{"style":243},[519],{"type":47,"value":520}," {",{"type":42,"tag":237,"props":522,"children":523},{"style":243},[524],{"type":47,"value":266},{"type":42,"tag":237,"props":526,"children":527},{"style":315},[528],{"type":47,"value":529},"md5",{"type":42,"tag":237,"props":531,"children":532},{"style":243},[533],{"type":47,"value":266},{"type":42,"tag":237,"props":535,"children":536},{"style":243},[537],{"type":47,"value":271},{"type":42,"tag":237,"props":539,"children":540},{"style":243},[541],{"type":47,"value":276},{"type":42,"tag":237,"props":543,"children":544},{"style":279},[545],{"type":47,"value":546},"...",{"type":42,"tag":237,"props":548,"children":549},{"style":243},[550],{"type":47,"value":266},{"type":42,"tag":237,"props":552,"children":553},{"style":243},[554],{"type":47,"value":555},",",{"type":42,"tag":237,"props":557,"children":558},{"style":243},[559],{"type":47,"value":276},{"type":42,"tag":237,"props":561,"children":562},{"style":315},[563],{"type":47,"value":564},"sha1",{"type":42,"tag":237,"props":566,"children":567},{"style":243},[568],{"type":47,"value":266},{"type":42,"tag":237,"props":570,"children":571},{"style":243},[572],{"type":47,"value":271},{"type":42,"tag":237,"props":574,"children":575},{"style":243},[576],{"type":47,"value":276},{"type":42,"tag":237,"props":578,"children":579},{"style":279},[580],{"type":47,"value":546},{"type":42,"tag":237,"props":582,"children":583},{"style":243},[584],{"type":47,"value":266},{"type":42,"tag":237,"props":586,"children":587},{"style":243},[588],{"type":47,"value":555},{"type":42,"tag":237,"props":590,"children":591},{"style":243},[592],{"type":47,"value":276},{"type":42,"tag":237,"props":594,"children":595},{"style":315},[596],{"type":47,"value":597},"sha256",{"type":42,"tag":237,"props":599,"children":600},{"style":243},[601],{"type":47,"value":266},{"type":42,"tag":237,"props":603,"children":604},{"style":243},[605],{"type":47,"value":271},{"type":42,"tag":237,"props":607,"children":608},{"style":243},[609],{"type":47,"value":276},{"type":42,"tag":237,"props":611,"children":612},{"style":279},[613],{"type":47,"value":546},{"type":42,"tag":237,"props":615,"children":616},{"style":243},[617],{"type":47,"value":266},{"type":42,"tag":237,"props":619,"children":620},{"style":243},[621],{"type":47,"value":622},"},\n",{"type":42,"tag":237,"props":624,"children":626},{"class":239,"line":625},10,[627,631,636,640,644,648,653,657],{"type":42,"tag":237,"props":628,"children":629},{"style":243},[630],{"type":47,"value":501},{"type":42,"tag":237,"props":632,"children":633},{"style":504},[634],{"type":47,"value":635},"file_type",{"type":42,"tag":237,"props":637,"children":638},{"style":243},[639],{"type":47,"value":266},{"type":42,"tag":237,"props":641,"children":642},{"style":243},[643],{"type":47,"value":271},{"type":42,"tag":237,"props":645,"children":646},{"style":243},[647],{"type":47,"value":276},{"type":42,"tag":237,"props":649,"children":650},{"style":279},[651],{"type":47,"value":652},"\u003Cfrom `file` command>",{"type":42,"tag":237,"props":654,"children":655},{"style":243},[656],{"type":47,"value":266},{"type":42,"tag":237,"props":658,"children":659},{"style":243},[660],{"type":47,"value":291},{"type":42,"tag":237,"props":662,"children":664},{"class":239,"line":663},11,[665,669,674,678,682,686,691,695],{"type":42,"tag":237,"props":666,"children":667},{"style":243},[668],{"type":47,"value":501},{"type":42,"tag":237,"props":670,"children":671},{"style":504},[672],{"type":47,"value":673},"file_type_magika",{"type":42,"tag":237,"props":675,"children":676},{"style":243},[677],{"type":47,"value":266},{"type":42,"tag":237,"props":679,"children":680},{"style":243},[681],{"type":47,"value":271},{"type":42,"tag":237,"props":683,"children":684},{"style":243},[685],{"type":47,"value":276},{"type":42,"tag":237,"props":687,"children":688},{"style":279},[689],{"type":47,"value":690},"\u003Cfrom magika>",{"type":42,"tag":237,"props":692,"children":693},{"style":243},[694],{"type":47,"value":266},{"type":42,"tag":237,"props":696,"children":697},{"style":243},[698],{"type":47,"value":291},{"type":42,"tag":237,"props":700,"children":702},{"class":239,"line":701},12,[703,707,712,716,720,725,730],{"type":42,"tag":237,"props":704,"children":705},{"style":243},[706],{"type":47,"value":501},{"type":42,"tag":237,"props":708,"children":709},{"style":504},[710],{"type":47,"value":711},"file_type_disagreement",{"type":42,"tag":237,"props":713,"children":714},{"style":243},[715],{"type":47,"value":266},{"type":42,"tag":237,"props":717,"children":718},{"style":243},[719],{"type":47,"value":271},{"type":42,"tag":237,"props":721,"children":722},{"style":243},[723],{"type":47,"value":724}," true",{"type":42,"tag":237,"props":726,"children":727},{"style":459},[728],{"type":47,"value":729},"|",{"type":42,"tag":237,"props":731,"children":732},{"style":243},[733],{"type":47,"value":734},"false,\n",{"type":42,"tag":237,"props":736,"children":738},{"class":239,"line":737},13,[739,743,748,752,756,760,765,769],{"type":42,"tag":237,"props":740,"children":741},{"style":243},[742],{"type":47,"value":501},{"type":42,"tag":237,"props":744,"children":745},{"style":504},[746],{"type":47,"value":747},"compile_timestamp",{"type":42,"tag":237,"props":749,"children":750},{"style":243},[751],{"type":47,"value":266},{"type":42,"tag":237,"props":753,"children":754},{"style":243},[755],{"type":47,"value":271},{"type":42,"tag":237,"props":757,"children":758},{"style":243},[759],{"type":47,"value":276},{"type":42,"tag":237,"props":761,"children":762},{"style":279},[763],{"type":47,"value":764},"\u003CISO8601 or null>",{"type":42,"tag":237,"props":766,"children":767},{"style":243},[768],{"type":47,"value":266},{"type":42,"tag":237,"props":770,"children":771},{"style":243},[772],{"type":47,"value":291},{"type":42,"tag":237,"props":774,"children":776},{"class":239,"line":775},14,[777,781,786,790,794,798,803,807],{"type":42,"tag":237,"props":778,"children":779},{"style":243},[780],{"type":47,"value":501},{"type":42,"tag":237,"props":782,"children":783},{"style":504},[784],{"type":47,"value":785},"signature_status",{"type":42,"tag":237,"props":787,"children":788},{"style":243},[789],{"type":47,"value":266},{"type":42,"tag":237,"props":791,"children":792},{"style":243},[793],{"type":47,"value":271},{"type":42,"tag":237,"props":795,"children":796},{"style":243},[797],{"type":47,"value":276},{"type":42,"tag":237,"props":799,"children":800},{"style":279},[801],{"type":47,"value":802},"valid | invalid | unsigned | unknown",{"type":42,"tag":237,"props":804,"children":805},{"style":243},[806],{"type":47,"value":266},{"type":42,"tag":237,"props":808,"children":809},{"style":243},[810],{"type":47,"value":291},{"type":42,"tag":237,"props":812,"children":814},{"class":239,"line":813},15,[815,819,824,828,832,837,841,846,850,854,858,862,866,870,874,879,883,887,892,896,900,905,909,913],{"type":42,"tag":237,"props":816,"children":817},{"style":243},[818],{"type":47,"value":501},{"type":42,"tag":237,"props":820,"children":821},{"style":504},[822],{"type":47,"value":823},"sections",{"type":42,"tag":237,"props":825,"children":826},{"style":243},[827],{"type":47,"value":266},{"type":42,"tag":237,"props":829,"children":830},{"style":243},[831],{"type":47,"value":271},{"type":42,"tag":237,"props":833,"children":834},{"style":243},[835],{"type":47,"value":836}," [{",{"type":42,"tag":237,"props":838,"children":839},{"style":243},[840],{"type":47,"value":266},{"type":42,"tag":237,"props":842,"children":843},{"style":315},[844],{"type":47,"value":845},"name",{"type":42,"tag":237,"props":847,"children":848},{"style":243},[849],{"type":47,"value":266},{"type":42,"tag":237,"props":851,"children":852},{"style":243},[853],{"type":47,"value":271},{"type":42,"tag":237,"props":855,"children":856},{"style":243},[857],{"type":47,"value":276},{"type":42,"tag":237,"props":859,"children":860},{"style":279},[861],{"type":47,"value":546},{"type":42,"tag":237,"props":863,"children":864},{"style":243},[865],{"type":47,"value":266},{"type":42,"tag":237,"props":867,"children":868},{"style":243},[869],{"type":47,"value":555},{"type":42,"tag":237,"props":871,"children":872},{"style":243},[873],{"type":47,"value":276},{"type":42,"tag":237,"props":875,"children":876},{"style":315},[877],{"type":47,"value":878},"entropy",{"type":42,"tag":237,"props":880,"children":881},{"style":243},[882],{"type":47,"value":266},{"type":42,"tag":237,"props":884,"children":885},{"style":243},[886],{"type":47,"value":271},{"type":42,"tag":237,"props":888,"children":889},{"style":315},[890],{"type":47,"value":891}," 7.23",{"type":42,"tag":237,"props":893,"children":894},{"style":243},[895],{"type":47,"value":555},{"type":42,"tag":237,"props":897,"children":898},{"style":243},[899],{"type":47,"value":276},{"type":42,"tag":237,"props":901,"children":902},{"style":315},[903],{"type":47,"value":904},"packed_flag",{"type":42,"tag":237,"props":906,"children":907},{"style":243},[908],{"type":47,"value":266},{"type":42,"tag":237,"props":910,"children":911},{"style":243},[912],{"type":47,"value":271},{"type":42,"tag":237,"props":914,"children":915},{"style":243},[916],{"type":47,"value":917}," true}],\n",{"type":42,"tag":237,"props":919,"children":921},{"class":239,"line":920},16,[922,926,931,935,939,944,948,952,956,960,964,968,972],{"type":42,"tag":237,"props":923,"children":924},{"style":243},[925],{"type":47,"value":501},{"type":42,"tag":237,"props":927,"children":928},{"style":504},[929],{"type":47,"value":930},"strings_sample",{"type":42,"tag":237,"props":932,"children":933},{"style":243},[934],{"type":47,"value":266},{"type":42,"tag":237,"props":936,"children":937},{"style":243},[938],{"type":47,"value":271},{"type":42,"tag":237,"props":940,"children":941},{"style":243},[942],{"type":47,"value":943}," [",{"type":42,"tag":237,"props":945,"children":946},{"style":243},[947],{"type":47,"value":266},{"type":42,"tag":237,"props":949,"children":950},{"style":279},[951],{"type":47,"value":546},{"type":42,"tag":237,"props":953,"children":954},{"style":243},[955],{"type":47,"value":266},{"type":42,"tag":237,"props":957,"children":958},{"style":243},[959],{"type":47,"value":555},{"type":42,"tag":237,"props":961,"children":962},{"style":243},[963],{"type":47,"value":276},{"type":42,"tag":237,"props":965,"children":966},{"style":279},[967],{"type":47,"value":546},{"type":42,"tag":237,"props":969,"children":970},{"style":243},[971],{"type":47,"value":266},{"type":42,"tag":237,"props":973,"children":974},{"style":243},[975],{"type":47,"value":976},"],\n",{"type":42,"tag":237,"props":978,"children":980},{"class":239,"line":979},17,[981,985,990,994,998],{"type":42,"tag":237,"props":982,"children":983},{"style":243},[984],{"type":47,"value":501},{"type":42,"tag":237,"props":986,"children":987},{"style":504},[988],{"type":47,"value":989},"candidate_iocs",{"type":42,"tag":237,"props":991,"children":992},{"style":243},[993],{"type":47,"value":266},{"type":42,"tag":237,"props":995,"children":996},{"style":243},[997],{"type":47,"value":271},{"type":42,"tag":237,"props":999,"children":1000},{"style":243},[1001],{"type":47,"value":492},{"type":42,"tag":237,"props":1003,"children":1005},{"class":239,"line":1004},18,[1006,1011,1016,1020,1024],{"type":42,"tag":237,"props":1007,"children":1008},{"style":243},[1009],{"type":47,"value":1010},"      \"",{"type":42,"tag":237,"props":1012,"children":1013},{"style":315},[1014],{"type":47,"value":1015},"domains",{"type":42,"tag":237,"props":1017,"children":1018},{"style":243},[1019],{"type":47,"value":266},{"type":42,"tag":237,"props":1021,"children":1022},{"style":243},[1023],{"type":47,"value":271},{"type":42,"tag":237,"props":1025,"children":1026},{"style":243},[1027],{"type":47,"value":1028}," [],\n",{"type":42,"tag":237,"props":1030,"children":1032},{"class":239,"line":1031},19,[1033,1037,1042,1046,1050],{"type":42,"tag":237,"props":1034,"children":1035},{"style":243},[1036],{"type":47,"value":1010},{"type":42,"tag":237,"props":1038,"children":1039},{"style":315},[1040],{"type":47,"value":1041},"ips",{"type":42,"tag":237,"props":1043,"children":1044},{"style":243},[1045],{"type":47,"value":266},{"type":42,"tag":237,"props":1047,"children":1048},{"style":243},[1049],{"type":47,"value":271},{"type":42,"tag":237,"props":1051,"children":1052},{"style":243},[1053],{"type":47,"value":1028},{"type":42,"tag":237,"props":1055,"children":1057},{"class":239,"line":1056},20,[1058,1062,1067,1071,1075],{"type":42,"tag":237,"props":1059,"children":1060},{"style":243},[1061],{"type":47,"value":1010},{"type":42,"tag":237,"props":1063,"children":1064},{"style":315},[1065],{"type":47,"value":1066},"urls",{"type":42,"tag":237,"props":1068,"children":1069},{"style":243},[1070],{"type":47,"value":266},{"type":42,"tag":237,"props":1072,"children":1073},{"style":243},[1074],{"type":47,"value":271},{"type":42,"tag":237,"props":1076,"children":1077},{"style":243},[1078],{"type":47,"value":1028},{"type":42,"tag":237,"props":1080,"children":1082},{"class":239,"line":1081},21,[1083,1087,1092,1096,1100],{"type":42,"tag":237,"props":1084,"children":1085},{"style":243},[1086],{"type":47,"value":1010},{"type":42,"tag":237,"props":1088,"children":1089},{"style":315},[1090],{"type":47,"value":1091},"registry_paths",{"type":42,"tag":237,"props":1093,"children":1094},{"style":243},[1095],{"type":47,"value":266},{"type":42,"tag":237,"props":1097,"children":1098},{"style":243},[1099],{"type":47,"value":271},{"type":42,"tag":237,"props":1101,"children":1102},{"style":243},[1103],{"type":47,"value":1028},{"type":42,"tag":237,"props":1105,"children":1107},{"class":239,"line":1106},22,[1108,1112,1117,1121,1125],{"type":42,"tag":237,"props":1109,"children":1110},{"style":243},[1111],{"type":47,"value":1010},{"type":42,"tag":237,"props":1113,"children":1114},{"style":315},[1115],{"type":47,"value":1116},"mutexes",{"type":42,"tag":237,"props":1118,"children":1119},{"style":243},[1120],{"type":47,"value":266},{"type":42,"tag":237,"props":1122,"children":1123},{"style":243},[1124],{"type":47,"value":271},{"type":42,"tag":237,"props":1126,"children":1127},{"style":243},[1128],{"type":47,"value":1129}," []\n",{"type":42,"tag":237,"props":1131,"children":1133},{"class":239,"line":1132},23,[1134],{"type":42,"tag":237,"props":1135,"children":1136},{"style":243},[1137],{"type":47,"value":1138},"    }\n",{"type":42,"tag":237,"props":1140,"children":1142},{"class":239,"line":1141},24,[1143],{"type":42,"tag":237,"props":1144,"children":1145},{"style":243},[1146],{"type":47,"value":1147},"  },\n",{"type":42,"tag":237,"props":1149,"children":1151},{"class":239,"line":1150},25,[1152,1156,1161,1165,1169,1173],{"type":42,"tag":237,"props":1153,"children":1154},{"style":243},[1155],{"type":47,"value":255},{"type":42,"tag":237,"props":1157,"children":1158},{"style":258},[1159],{"type":47,"value":1160},"tool_calls",{"type":42,"tag":237,"props":1162,"children":1163},{"style":243},[1164],{"type":47,"value":266},{"type":42,"tag":237,"props":1166,"children":1167},{"style":243},[1168],{"type":47,"value":271},{"type":42,"tag":237,"props":1170,"children":1171},{"style":459},[1172],{"type":47,"value":462},{"type":42,"tag":237,"props":1174,"children":1175},{"style":243},[1176],{"type":47,"value":291},{"type":42,"tag":237,"props":1178,"children":1180},{"class":239,"line":1179},26,[1181,1185,1190,1194,1198,1202,1207],{"type":42,"tag":237,"props":1182,"children":1183},{"style":243},[1184],{"type":47,"value":255},{"type":42,"tag":237,"props":1186,"children":1187},{"style":258},[1188],{"type":47,"value":1189},"notes",{"type":42,"tag":237,"props":1191,"children":1192},{"style":243},[1193],{"type":47,"value":266},{"type":42,"tag":237,"props":1195,"children":1196},{"style":243},[1197],{"type":47,"value":271},{"type":42,"tag":237,"props":1199,"children":1200},{"style":243},[1201],{"type":47,"value":276},{"type":42,"tag":237,"props":1203,"children":1204},{"style":279},[1205],{"type":47,"value":1206},"free text",{"type":42,"tag":237,"props":1208,"children":1209},{"style":243},[1210],{"type":47,"value":1211},"\"\n",{"type":42,"tag":237,"props":1213,"children":1215},{"class":239,"line":1214},27,[1216],{"type":42,"tag":237,"props":1217,"children":1218},{"style":243},[1219],{"type":47,"value":1220},"}\n",{"type":42,"tag":61,"props":1222,"children":1224},{"id":1223},"steps",[1225],{"type":47,"value":1226},"Steps",{"type":42,"tag":1228,"props":1229,"children":1231},"h3",{"id":1230},"_1-check-ddb-for-cached-result",[1232],{"type":47,"value":1233},"1. Check DDB for cached result",{"type":42,"tag":226,"props":1235,"children":1239},{"className":1236,"code":1237,"language":1238,"meta":231,"style":231},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","aws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a AND begins_with(stage_timestamp, :s)\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"},\":s\":{\"S\":\"triage#\"}}' \\\n  --query 'Items[0]' --output json\n","bash",[1240],{"type":42,"tag":107,"props":1241,"children":1242},{"__ignoreMap":231},[1243,1276,1301,1326,1373],{"type":42,"tag":237,"props":1244,"children":1245},{"class":239,"line":26},[1246,1251,1256,1261,1266,1271],{"type":42,"tag":237,"props":1247,"children":1248},{"style":504},[1249],{"type":47,"value":1250},"aws",{"type":42,"tag":237,"props":1252,"children":1253},{"style":279},[1254],{"type":47,"value":1255}," dynamodb",{"type":42,"tag":237,"props":1257,"children":1258},{"style":279},[1259],{"type":47,"value":1260}," query",{"type":42,"tag":237,"props":1262,"children":1263},{"style":279},[1264],{"type":47,"value":1265}," --region",{"type":42,"tag":237,"props":1267,"children":1268},{"style":279},[1269],{"type":47,"value":1270}," us-east-1",{"type":42,"tag":237,"props":1272,"children":1273},{"style":459},[1274],{"type":47,"value":1275}," \\\n",{"type":42,"tag":237,"props":1277,"children":1278},{"class":239,"line":249},[1279,1284,1288,1293,1297],{"type":42,"tag":237,"props":1280,"children":1281},{"style":279},[1282],{"type":47,"value":1283},"  --table-name",{"type":42,"tag":237,"props":1285,"children":1286},{"style":243},[1287],{"type":47,"value":276},{"type":42,"tag":237,"props":1289,"children":1290},{"style":459},[1291],{"type":47,"value":1292},"$CYBER_RESULTS_TABLE",{"type":42,"tag":237,"props":1294,"children":1295},{"style":243},[1296],{"type":47,"value":266},{"type":42,"tag":237,"props":1298,"children":1299},{"style":459},[1300],{"type":47,"value":1275},{"type":42,"tag":237,"props":1302,"children":1303},{"class":239,"line":294},[1304,1309,1313,1318,1322],{"type":42,"tag":237,"props":1305,"children":1306},{"style":279},[1307],{"type":47,"value":1308},"  --key-condition-expression",{"type":42,"tag":237,"props":1310,"children":1311},{"style":243},[1312],{"type":47,"value":276},{"type":42,"tag":237,"props":1314,"children":1315},{"style":279},[1316],{"type":47,"value":1317},"artifact_id = :a AND begins_with(stage_timestamp, :s)",{"type":42,"tag":237,"props":1319,"children":1320},{"style":243},[1321],{"type":47,"value":266},{"type":42,"tag":237,"props":1323,"children":1324},{"style":459},[1325],{"type":47,"value":1275},{"type":42,"tag":237,"props":1327,"children":1328},{"class":239,"line":325},[1329,1334,1339,1344,1349,1354,1359,1364,1369],{"type":42,"tag":237,"props":1330,"children":1331},{"style":279},[1332],{"type":47,"value":1333},"  --expression-attribute-values",{"type":42,"tag":237,"props":1335,"children":1336},{"style":243},[1337],{"type":47,"value":1338}," '",{"type":42,"tag":237,"props":1340,"children":1341},{"style":279},[1342],{"type":47,"value":1343},"{\":a\":{\"S\":\"",{"type":42,"tag":237,"props":1345,"children":1346},{"style":243},[1347],{"type":47,"value":1348},"'\"",{"type":42,"tag":237,"props":1350,"children":1351},{"style":459},[1352],{"type":47,"value":1353},"$ARTIFACT_ID",{"type":42,"tag":237,"props":1355,"children":1356},{"style":243},[1357],{"type":47,"value":1358},"\"'",{"type":42,"tag":237,"props":1360,"children":1361},{"style":279},[1362],{"type":47,"value":1363},"\"},\":s\":{\"S\":\"triage#\"}}",{"type":42,"tag":237,"props":1365,"children":1366},{"style":243},[1367],{"type":47,"value":1368},"'",{"type":42,"tag":237,"props":1370,"children":1371},{"style":459},[1372],{"type":47,"value":1275},{"type":42,"tag":237,"props":1374,"children":1375},{"class":239,"line":362},[1376,1381,1385,1390,1394,1399],{"type":42,"tag":237,"props":1377,"children":1378},{"style":279},[1379],{"type":47,"value":1380},"  --query",{"type":42,"tag":237,"props":1382,"children":1383},{"style":243},[1384],{"type":47,"value":1338},{"type":42,"tag":237,"props":1386,"children":1387},{"style":279},[1388],{"type":47,"value":1389},"Items[0]",{"type":42,"tag":237,"props":1391,"children":1392},{"style":243},[1393],{"type":47,"value":1368},{"type":42,"tag":237,"props":1395,"children":1396},{"style":279},[1397],{"type":47,"value":1398}," --output",{"type":42,"tag":237,"props":1400,"children":1401},{"style":279},[1402],{"type":47,"value":1403}," json\n",{"type":42,"tag":50,"props":1405,"children":1406},{},[1407],{"type":47,"value":1408},"If a row exists and is recent (\u003C 7 days), reuse it — skip to step 4.",{"type":42,"tag":1228,"props":1410,"children":1412},{"id":1411},"_2-send-to-triage-queue",[1413],{"type":47,"value":1414},"2. Send to triage queue",{"type":42,"tag":226,"props":1416,"children":1418},{"className":1236,"code":1417,"language":1238,"meta":231,"style":231},"MSG_ID=$(aws sqs send-message --region us-east-1 \\\n  --queue-url \"$CYBER_TRIAGE_QUEUE\" \\\n  --message-group-id \"$ARTIFACT_ID\" \\\n  --message-deduplication-id \"${ARTIFACT_ID}-triage-$(date +%s)\" \\\n  --message-body \"{\\\"artifact_id\\\":\\\"$ARTIFACT_ID\\\",\\\"sample_s3_uri\\\":\\\"$SAMPLE_S3_URI\\\",\\\"stage\\\":\\\"triage\\\"}\" \\\n  --query 'MessageId' --output text)\necho \"Enqueued triage: $MSG_ID\"\n",[1419],{"type":42,"tag":107,"props":1420,"children":1421},{"__ignoreMap":231},[1422,1461,1486,1510,1561,1670,1704],{"type":42,"tag":237,"props":1423,"children":1424},{"class":239,"line":26},[1425,1430,1435,1439,1444,1449,1453,1457],{"type":42,"tag":237,"props":1426,"children":1427},{"style":459},[1428],{"type":47,"value":1429},"MSG_ID",{"type":42,"tag":237,"props":1431,"children":1432},{"style":243},[1433],{"type":47,"value":1434},"=$(",{"type":42,"tag":237,"props":1436,"children":1437},{"style":504},[1438],{"type":47,"value":1250},{"type":42,"tag":237,"props":1440,"children":1441},{"style":279},[1442],{"type":47,"value":1443}," sqs",{"type":42,"tag":237,"props":1445,"children":1446},{"style":279},[1447],{"type":47,"value":1448}," send-message",{"type":42,"tag":237,"props":1450,"children":1451},{"style":279},[1452],{"type":47,"value":1265},{"type":42,"tag":237,"props":1454,"children":1455},{"style":279},[1456],{"type":47,"value":1270},{"type":42,"tag":237,"props":1458,"children":1459},{"style":459},[1460],{"type":47,"value":1275},{"type":42,"tag":237,"props":1462,"children":1463},{"class":239,"line":249},[1464,1469,1473,1478,1482],{"type":42,"tag":237,"props":1465,"children":1466},{"style":279},[1467],{"type":47,"value":1468},"  --queue-url",{"type":42,"tag":237,"props":1470,"children":1471},{"style":243},[1472],{"type":47,"value":276},{"type":42,"tag":237,"props":1474,"children":1475},{"style":459},[1476],{"type":47,"value":1477},"$CYBER_TRIAGE_QUEUE",{"type":42,"tag":237,"props":1479,"children":1480},{"style":243},[1481],{"type":47,"value":266},{"type":42,"tag":237,"props":1483,"children":1484},{"style":459},[1485],{"type":47,"value":1275},{"type":42,"tag":237,"props":1487,"children":1488},{"class":239,"line":294},[1489,1494,1498,1502,1506],{"type":42,"tag":237,"props":1490,"children":1491},{"style":279},[1492],{"type":47,"value":1493},"  --message-group-id",{"type":42,"tag":237,"props":1495,"children":1496},{"style":243},[1497],{"type":47,"value":276},{"type":42,"tag":237,"props":1499,"children":1500},{"style":459},[1501],{"type":47,"value":1353},{"type":42,"tag":237,"props":1503,"children":1504},{"style":243},[1505],{"type":47,"value":266},{"type":42,"tag":237,"props":1507,"children":1508},{"style":459},[1509],{"type":47,"value":1275},{"type":42,"tag":237,"props":1511,"children":1512},{"class":239,"line":325},[1513,1518,1523,1527,1532,1537,1542,1547,1552,1557],{"type":42,"tag":237,"props":1514,"children":1515},{"style":279},[1516],{"type":47,"value":1517},"  --message-deduplication-id",{"type":42,"tag":237,"props":1519,"children":1520},{"style":243},[1521],{"type":47,"value":1522}," \"${",{"type":42,"tag":237,"props":1524,"children":1525},{"style":459},[1526],{"type":47,"value":112},{"type":42,"tag":237,"props":1528,"children":1529},{"style":243},[1530],{"type":47,"value":1531},"}",{"type":42,"tag":237,"props":1533,"children":1534},{"style":279},[1535],{"type":47,"value":1536},"-triage-",{"type":42,"tag":237,"props":1538,"children":1539},{"style":243},[1540],{"type":47,"value":1541},"$(",{"type":42,"tag":237,"props":1543,"children":1544},{"style":504},[1545],{"type":47,"value":1546},"date",{"type":42,"tag":237,"props":1548,"children":1549},{"style":279},[1550],{"type":47,"value":1551}," +%s",{"type":42,"tag":237,"props":1553,"children":1554},{"style":243},[1555],{"type":47,"value":1556},")\"",{"type":42,"tag":237,"props":1558,"children":1559},{"style":459},[1560],{"type":47,"value":1275},{"type":42,"tag":237,"props":1562,"children":1563},{"class":239,"line":362},[1564,1569,1573,1578,1583,1587,1591,1595,1600,1604,1608,1613,1617,1621,1626,1630,1634,1638,1642,1646,1650,1654,1658,1662,1666],{"type":42,"tag":237,"props":1565,"children":1566},{"style":279},[1567],{"type":47,"value":1568},"  --message-body",{"type":42,"tag":237,"props":1570,"children":1571},{"style":243},[1572],{"type":47,"value":276},{"type":42,"tag":237,"props":1574,"children":1575},{"style":279},[1576],{"type":47,"value":1577},"{",{"type":42,"tag":237,"props":1579,"children":1580},{"style":459},[1581],{"type":47,"value":1582},"\\\"",{"type":42,"tag":237,"props":1584,"children":1585},{"style":279},[1586],{"type":47,"value":261},{"type":42,"tag":237,"props":1588,"children":1589},{"style":459},[1590],{"type":47,"value":1582},{"type":42,"tag":237,"props":1592,"children":1593},{"style":279},[1594],{"type":47,"value":271},{"type":42,"tag":237,"props":1596,"children":1597},{"style":459},[1598],{"type":47,"value":1599},"\\\"$ARTIFACT_ID\\\"",{"type":42,"tag":237,"props":1601,"children":1602},{"style":279},[1603],{"type":47,"value":555},{"type":42,"tag":237,"props":1605,"children":1606},{"style":459},[1607],{"type":47,"value":1582},{"type":42,"tag":237,"props":1609,"children":1610},{"style":279},[1611],{"type":47,"value":1612},"sample_s3_uri",{"type":42,"tag":237,"props":1614,"children":1615},{"style":459},[1616],{"type":47,"value":1582},{"type":42,"tag":237,"props":1618,"children":1619},{"style":279},[1620],{"type":47,"value":271},{"type":42,"tag":237,"props":1622,"children":1623},{"style":459},[1624],{"type":47,"value":1625},"\\\"$SAMPLE_S3_URI\\\"",{"type":42,"tag":237,"props":1627,"children":1628},{"style":279},[1629],{"type":47,"value":555},{"type":42,"tag":237,"props":1631,"children":1632},{"style":459},[1633],{"type":47,"value":1582},{"type":42,"tag":237,"props":1635,"children":1636},{"style":279},[1637],{"type":47,"value":304},{"type":42,"tag":237,"props":1639,"children":1640},{"style":459},[1641],{"type":47,"value":1582},{"type":42,"tag":237,"props":1643,"children":1644},{"style":279},[1645],{"type":47,"value":271},{"type":42,"tag":237,"props":1647,"children":1648},{"style":459},[1649],{"type":47,"value":1582},{"type":42,"tag":237,"props":1651,"children":1652},{"style":279},[1653],{"type":47,"value":19},{"type":42,"tag":237,"props":1655,"children":1656},{"style":459},[1657],{"type":47,"value":1582},{"type":42,"tag":237,"props":1659,"children":1660},{"style":279},[1661],{"type":47,"value":1531},{"type":42,"tag":237,"props":1663,"children":1664},{"style":243},[1665],{"type":47,"value":266},{"type":42,"tag":237,"props":1667,"children":1668},{"style":459},[1669],{"type":47,"value":1275},{"type":42,"tag":237,"props":1671,"children":1672},{"class":239,"line":400},[1673,1677,1681,1686,1690,1694,1699],{"type":42,"tag":237,"props":1674,"children":1675},{"style":279},[1676],{"type":47,"value":1380},{"type":42,"tag":237,"props":1678,"children":1679},{"style":243},[1680],{"type":47,"value":1338},{"type":42,"tag":237,"props":1682,"children":1683},{"style":279},[1684],{"type":47,"value":1685},"MessageId",{"type":42,"tag":237,"props":1687,"children":1688},{"style":243},[1689],{"type":47,"value":1368},{"type":42,"tag":237,"props":1691,"children":1692},{"style":279},[1693],{"type":47,"value":1398},{"type":42,"tag":237,"props":1695,"children":1696},{"style":279},[1697],{"type":47,"value":1698}," text",{"type":42,"tag":237,"props":1700,"children":1701},{"style":243},[1702],{"type":47,"value":1703},")\n",{"type":42,"tag":237,"props":1705,"children":1706},{"class":239,"line":438},[1707,1713,1717,1722,1727],{"type":42,"tag":237,"props":1708,"children":1710},{"style":1709},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1711],{"type":47,"value":1712},"echo",{"type":42,"tag":237,"props":1714,"children":1715},{"style":243},[1716],{"type":47,"value":276},{"type":42,"tag":237,"props":1718,"children":1719},{"style":279},[1720],{"type":47,"value":1721},"Enqueued triage: ",{"type":42,"tag":237,"props":1723,"children":1724},{"style":459},[1725],{"type":47,"value":1726},"$MSG_ID",{"type":42,"tag":237,"props":1728,"children":1729},{"style":243},[1730],{"type":47,"value":1211},{"type":42,"tag":1228,"props":1732,"children":1734},{"id":1733},"_3-poll-the-response-queue",[1735],{"type":47,"value":1736},"3. Poll the response queue",{"type":42,"tag":226,"props":1738,"children":1740},{"className":1236,"code":1739,"language":1238,"meta":231,"style":231},"# Poll up to 3 minutes (triage is fast)\nfor i in $(seq 1 36); do\n  RESP=$(aws sqs receive-message --region us-east-1 \\\n    --queue-url \"$CYBER_TRIAGE_RESPONSE_QUEUE\" \\\n    --max-number-of-messages 1 \\\n    --wait-time-seconds 5 \\\n    --visibility-timeout 10 \\\n    --query 'Messages[0]' --output json)\n\n  if [ \"$RESP\" != \"null\" ] && [ -n \"$RESP\" ]; then\n    BODY=$(echo \"$RESP\" | jq -r '.Body')\n    RECEIPT=$(echo \"$RESP\" | jq -r '.ReceiptHandle')\n    # Check it's for our artifact\n    if echo \"$BODY\" | jq -e --arg a \"$ARTIFACT_ID\" '.artifact_id == $a' > \u002Fdev\u002Fnull; then\n      aws sqs delete-message --region us-east-1 \\\n        --queue-url \"$CYBER_TRIAGE_RESPONSE_QUEUE\" \\\n        --receipt-handle \"$RECEIPT\"\n      echo \"$BODY\"\n      break\n    fi\n  fi\n  sleep 5\ndone\n",[1741],{"type":42,"tag":107,"props":1742,"children":1743},{"__ignoreMap":231},[1744,1753,1801,1838,1863,1879,1896,1913,1947,1956,2040,2100,2157,2165,2258,2287,2311,2332,2352,2360,2368,2376,2389],{"type":42,"tag":237,"props":1745,"children":1746},{"class":239,"line":26},[1747],{"type":42,"tag":237,"props":1748,"children":1750},{"style":1749},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1751],{"type":47,"value":1752},"# Poll up to 3 minutes (triage is fast)\n",{"type":42,"tag":237,"props":1754,"children":1755},{"class":239,"line":249},[1756,1762,1767,1772,1777,1782,1786,1791,1796],{"type":42,"tag":237,"props":1757,"children":1759},{"style":1758},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1760],{"type":47,"value":1761},"for",{"type":42,"tag":237,"props":1763,"children":1764},{"style":459},[1765],{"type":47,"value":1766}," i ",{"type":42,"tag":237,"props":1768,"children":1769},{"style":1758},[1770],{"type":47,"value":1771},"in",{"type":42,"tag":237,"props":1773,"children":1774},{"style":243},[1775],{"type":47,"value":1776}," $(",{"type":42,"tag":237,"props":1778,"children":1779},{"style":504},[1780],{"type":47,"value":1781},"seq",{"type":42,"tag":237,"props":1783,"children":1784},{"style":315},[1785],{"type":47,"value":318},{"type":42,"tag":237,"props":1787,"children":1788},{"style":315},[1789],{"type":47,"value":1790}," 36",{"type":42,"tag":237,"props":1792,"children":1793},{"style":243},[1794],{"type":47,"value":1795},");",{"type":42,"tag":237,"props":1797,"children":1798},{"style":1758},[1799],{"type":47,"value":1800}," do\n",{"type":42,"tag":237,"props":1802,"children":1803},{"class":239,"line":294},[1804,1809,1813,1817,1821,1826,1830,1834],{"type":42,"tag":237,"props":1805,"children":1806},{"style":459},[1807],{"type":47,"value":1808},"  RESP",{"type":42,"tag":237,"props":1810,"children":1811},{"style":243},[1812],{"type":47,"value":1434},{"type":42,"tag":237,"props":1814,"children":1815},{"style":504},[1816],{"type":47,"value":1250},{"type":42,"tag":237,"props":1818,"children":1819},{"style":279},[1820],{"type":47,"value":1443},{"type":42,"tag":237,"props":1822,"children":1823},{"style":279},[1824],{"type":47,"value":1825}," receive-message",{"type":42,"tag":237,"props":1827,"children":1828},{"style":279},[1829],{"type":47,"value":1265},{"type":42,"tag":237,"props":1831,"children":1832},{"style":279},[1833],{"type":47,"value":1270},{"type":42,"tag":237,"props":1835,"children":1836},{"style":459},[1837],{"type":47,"value":1275},{"type":42,"tag":237,"props":1839,"children":1840},{"class":239,"line":325},[1841,1846,1850,1855,1859],{"type":42,"tag":237,"props":1842,"children":1843},{"style":279},[1844],{"type":47,"value":1845},"    --queue-url",{"type":42,"tag":237,"props":1847,"children":1848},{"style":243},[1849],{"type":47,"value":276},{"type":42,"tag":237,"props":1851,"children":1852},{"style":459},[1853],{"type":47,"value":1854},"$CYBER_TRIAGE_RESPONSE_QUEUE",{"type":42,"tag":237,"props":1856,"children":1857},{"style":243},[1858],{"type":47,"value":266},{"type":42,"tag":237,"props":1860,"children":1861},{"style":459},[1862],{"type":47,"value":1275},{"type":42,"tag":237,"props":1864,"children":1865},{"class":239,"line":362},[1866,1871,1875],{"type":42,"tag":237,"props":1867,"children":1868},{"style":279},[1869],{"type":47,"value":1870},"    --max-number-of-messages",{"type":42,"tag":237,"props":1872,"children":1873},{"style":315},[1874],{"type":47,"value":318},{"type":42,"tag":237,"props":1876,"children":1877},{"style":459},[1878],{"type":47,"value":1275},{"type":42,"tag":237,"props":1880,"children":1881},{"class":239,"line":400},[1882,1887,1892],{"type":42,"tag":237,"props":1883,"children":1884},{"style":279},[1885],{"type":47,"value":1886},"    --wait-time-seconds",{"type":42,"tag":237,"props":1888,"children":1889},{"style":315},[1890],{"type":47,"value":1891}," 5",{"type":42,"tag":237,"props":1893,"children":1894},{"style":459},[1895],{"type":47,"value":1275},{"type":42,"tag":237,"props":1897,"children":1898},{"class":239,"line":438},[1899,1904,1909],{"type":42,"tag":237,"props":1900,"children":1901},{"style":279},[1902],{"type":47,"value":1903},"    --visibility-timeout",{"type":42,"tag":237,"props":1905,"children":1906},{"style":315},[1907],{"type":47,"value":1908}," 10",{"type":42,"tag":237,"props":1910,"children":1911},{"style":459},[1912],{"type":47,"value":1275},{"type":42,"tag":237,"props":1914,"children":1915},{"class":239,"line":469},[1916,1921,1925,1930,1934,1938,1943],{"type":42,"tag":237,"props":1917,"children":1918},{"style":279},[1919],{"type":47,"value":1920},"    --query",{"type":42,"tag":237,"props":1922,"children":1923},{"style":243},[1924],{"type":47,"value":1338},{"type":42,"tag":237,"props":1926,"children":1927},{"style":279},[1928],{"type":47,"value":1929},"Messages[0]",{"type":42,"tag":237,"props":1931,"children":1932},{"style":243},[1933],{"type":47,"value":1368},{"type":42,"tag":237,"props":1935,"children":1936},{"style":279},[1937],{"type":47,"value":1398},{"type":42,"tag":237,"props":1939,"children":1940},{"style":279},[1941],{"type":47,"value":1942}," json",{"type":42,"tag":237,"props":1944,"children":1945},{"style":243},[1946],{"type":47,"value":1703},{"type":42,"tag":237,"props":1948,"children":1949},{"class":239,"line":495},[1950],{"type":42,"tag":237,"props":1951,"children":1953},{"emptyLinePlaceholder":1952},true,[1954],{"type":47,"value":1955},"\n",{"type":42,"tag":237,"props":1957,"children":1958},{"class":239,"line":625},[1959,1964,1968,1972,1977,1981,1986,1990,1995,1999,2004,2009,2013,2018,2022,2026,2030,2035],{"type":42,"tag":237,"props":1960,"children":1961},{"style":1758},[1962],{"type":47,"value":1963},"  if",{"type":42,"tag":237,"props":1965,"children":1966},{"style":243},[1967],{"type":47,"value":943},{"type":42,"tag":237,"props":1969,"children":1970},{"style":243},[1971],{"type":47,"value":276},{"type":42,"tag":237,"props":1973,"children":1974},{"style":459},[1975],{"type":47,"value":1976},"$RESP",{"type":42,"tag":237,"props":1978,"children":1979},{"style":243},[1980],{"type":47,"value":266},{"type":42,"tag":237,"props":1982,"children":1983},{"style":243},[1984],{"type":47,"value":1985}," !=",{"type":42,"tag":237,"props":1987,"children":1988},{"style":243},[1989],{"type":47,"value":276},{"type":42,"tag":237,"props":1991,"children":1992},{"style":279},[1993],{"type":47,"value":1994},"null",{"type":42,"tag":237,"props":1996,"children":1997},{"style":243},[1998],{"type":47,"value":266},{"type":42,"tag":237,"props":2000,"children":2001},{"style":243},[2002],{"type":47,"value":2003}," ]",{"type":42,"tag":237,"props":2005,"children":2006},{"style":243},[2007],{"type":47,"value":2008}," &&",{"type":42,"tag":237,"props":2010,"children":2011},{"style":243},[2012],{"type":47,"value":943},{"type":42,"tag":237,"props":2014,"children":2015},{"style":243},[2016],{"type":47,"value":2017}," -n",{"type":42,"tag":237,"props":2019,"children":2020},{"style":243},[2021],{"type":47,"value":276},{"type":42,"tag":237,"props":2023,"children":2024},{"style":459},[2025],{"type":47,"value":1976},{"type":42,"tag":237,"props":2027,"children":2028},{"style":243},[2029],{"type":47,"value":266},{"type":42,"tag":237,"props":2031,"children":2032},{"style":243},[2033],{"type":47,"value":2034}," ];",{"type":42,"tag":237,"props":2036,"children":2037},{"style":1758},[2038],{"type":47,"value":2039}," then\n",{"type":42,"tag":237,"props":2041,"children":2042},{"class":239,"line":663},[2043,2048,2052,2056,2060,2064,2068,2073,2078,2083,2087,2092,2096],{"type":42,"tag":237,"props":2044,"children":2045},{"style":459},[2046],{"type":47,"value":2047},"    BODY",{"type":42,"tag":237,"props":2049,"children":2050},{"style":243},[2051],{"type":47,"value":1434},{"type":42,"tag":237,"props":2053,"children":2054},{"style":1709},[2055],{"type":47,"value":1712},{"type":42,"tag":237,"props":2057,"children":2058},{"style":243},[2059],{"type":47,"value":276},{"type":42,"tag":237,"props":2061,"children":2062},{"style":459},[2063],{"type":47,"value":1976},{"type":42,"tag":237,"props":2065,"children":2066},{"style":243},[2067],{"type":47,"value":266},{"type":42,"tag":237,"props":2069,"children":2070},{"style":243},[2071],{"type":47,"value":2072}," |",{"type":42,"tag":237,"props":2074,"children":2075},{"style":504},[2076],{"type":47,"value":2077}," jq",{"type":42,"tag":237,"props":2079,"children":2080},{"style":279},[2081],{"type":47,"value":2082}," -r",{"type":42,"tag":237,"props":2084,"children":2085},{"style":243},[2086],{"type":47,"value":1338},{"type":42,"tag":237,"props":2088,"children":2089},{"style":279},[2090],{"type":47,"value":2091},".Body",{"type":42,"tag":237,"props":2093,"children":2094},{"style":243},[2095],{"type":47,"value":1368},{"type":42,"tag":237,"props":2097,"children":2098},{"style":243},[2099],{"type":47,"value":1703},{"type":42,"tag":237,"props":2101,"children":2102},{"class":239,"line":701},[2103,2108,2112,2116,2120,2124,2128,2132,2136,2140,2144,2149,2153],{"type":42,"tag":237,"props":2104,"children":2105},{"style":459},[2106],{"type":47,"value":2107},"    RECEIPT",{"type":42,"tag":237,"props":2109,"children":2110},{"style":243},[2111],{"type":47,"value":1434},{"type":42,"tag":237,"props":2113,"children":2114},{"style":1709},[2115],{"type":47,"value":1712},{"type":42,"tag":237,"props":2117,"children":2118},{"style":243},[2119],{"type":47,"value":276},{"type":42,"tag":237,"props":2121,"children":2122},{"style":459},[2123],{"type":47,"value":1976},{"type":42,"tag":237,"props":2125,"children":2126},{"style":243},[2127],{"type":47,"value":266},{"type":42,"tag":237,"props":2129,"children":2130},{"style":243},[2131],{"type":47,"value":2072},{"type":42,"tag":237,"props":2133,"children":2134},{"style":504},[2135],{"type":47,"value":2077},{"type":42,"tag":237,"props":2137,"children":2138},{"style":279},[2139],{"type":47,"value":2082},{"type":42,"tag":237,"props":2141,"children":2142},{"style":243},[2143],{"type":47,"value":1338},{"type":42,"tag":237,"props":2145,"children":2146},{"style":279},[2147],{"type":47,"value":2148},".ReceiptHandle",{"type":42,"tag":237,"props":2150,"children":2151},{"style":243},[2152],{"type":47,"value":1368},{"type":42,"tag":237,"props":2154,"children":2155},{"style":243},[2156],{"type":47,"value":1703},{"type":42,"tag":237,"props":2158,"children":2159},{"class":239,"line":737},[2160],{"type":42,"tag":237,"props":2161,"children":2162},{"style":1749},[2163],{"type":47,"value":2164},"    # Check it's for our artifact\n",{"type":42,"tag":237,"props":2166,"children":2167},{"class":239,"line":775},[2168,2173,2178,2182,2187,2191,2195,2199,2204,2209,2214,2218,2222,2226,2230,2235,2239,2244,2249,2254],{"type":42,"tag":237,"props":2169,"children":2170},{"style":1758},[2171],{"type":47,"value":2172},"    if",{"type":42,"tag":237,"props":2174,"children":2175},{"style":1709},[2176],{"type":47,"value":2177}," echo",{"type":42,"tag":237,"props":2179,"children":2180},{"style":243},[2181],{"type":47,"value":276},{"type":42,"tag":237,"props":2183,"children":2184},{"style":459},[2185],{"type":47,"value":2186},"$BODY",{"type":42,"tag":237,"props":2188,"children":2189},{"style":243},[2190],{"type":47,"value":266},{"type":42,"tag":237,"props":2192,"children":2193},{"style":243},[2194],{"type":47,"value":2072},{"type":42,"tag":237,"props":2196,"children":2197},{"style":504},[2198],{"type":47,"value":2077},{"type":42,"tag":237,"props":2200,"children":2201},{"style":279},[2202],{"type":47,"value":2203}," -e",{"type":42,"tag":237,"props":2205,"children":2206},{"style":279},[2207],{"type":47,"value":2208}," --arg",{"type":42,"tag":237,"props":2210,"children":2211},{"style":279},[2212],{"type":47,"value":2213}," a",{"type":42,"tag":237,"props":2215,"children":2216},{"style":243},[2217],{"type":47,"value":276},{"type":42,"tag":237,"props":2219,"children":2220},{"style":459},[2221],{"type":47,"value":1353},{"type":42,"tag":237,"props":2223,"children":2224},{"style":243},[2225],{"type":47,"value":266},{"type":42,"tag":237,"props":2227,"children":2228},{"style":243},[2229],{"type":47,"value":1338},{"type":42,"tag":237,"props":2231,"children":2232},{"style":279},[2233],{"type":47,"value":2234},".artifact_id == $a",{"type":42,"tag":237,"props":2236,"children":2237},{"style":243},[2238],{"type":47,"value":1368},{"type":42,"tag":237,"props":2240,"children":2241},{"style":243},[2242],{"type":47,"value":2243}," >",{"type":42,"tag":237,"props":2245,"children":2246},{"style":279},[2247],{"type":47,"value":2248}," \u002Fdev\u002Fnull",{"type":42,"tag":237,"props":2250,"children":2251},{"style":243},[2252],{"type":47,"value":2253},";",{"type":42,"tag":237,"props":2255,"children":2256},{"style":1758},[2257],{"type":47,"value":2039},{"type":42,"tag":237,"props":2259,"children":2260},{"class":239,"line":813},[2261,2266,2270,2275,2279,2283],{"type":42,"tag":237,"props":2262,"children":2263},{"style":504},[2264],{"type":47,"value":2265},"      aws",{"type":42,"tag":237,"props":2267,"children":2268},{"style":279},[2269],{"type":47,"value":1443},{"type":42,"tag":237,"props":2271,"children":2272},{"style":279},[2273],{"type":47,"value":2274}," delete-message",{"type":42,"tag":237,"props":2276,"children":2277},{"style":279},[2278],{"type":47,"value":1265},{"type":42,"tag":237,"props":2280,"children":2281},{"style":279},[2282],{"type":47,"value":1270},{"type":42,"tag":237,"props":2284,"children":2285},{"style":459},[2286],{"type":47,"value":1275},{"type":42,"tag":237,"props":2288,"children":2289},{"class":239,"line":920},[2290,2295,2299,2303,2307],{"type":42,"tag":237,"props":2291,"children":2292},{"style":279},[2293],{"type":47,"value":2294},"        --queue-url",{"type":42,"tag":237,"props":2296,"children":2297},{"style":243},[2298],{"type":47,"value":276},{"type":42,"tag":237,"props":2300,"children":2301},{"style":459},[2302],{"type":47,"value":1854},{"type":42,"tag":237,"props":2304,"children":2305},{"style":243},[2306],{"type":47,"value":266},{"type":42,"tag":237,"props":2308,"children":2309},{"style":459},[2310],{"type":47,"value":1275},{"type":42,"tag":237,"props":2312,"children":2313},{"class":239,"line":979},[2314,2319,2323,2328],{"type":42,"tag":237,"props":2315,"children":2316},{"style":279},[2317],{"type":47,"value":2318},"        --receipt-handle",{"type":42,"tag":237,"props":2320,"children":2321},{"style":243},[2322],{"type":47,"value":276},{"type":42,"tag":237,"props":2324,"children":2325},{"style":459},[2326],{"type":47,"value":2327},"$RECEIPT",{"type":42,"tag":237,"props":2329,"children":2330},{"style":243},[2331],{"type":47,"value":1211},{"type":42,"tag":237,"props":2333,"children":2334},{"class":239,"line":1004},[2335,2340,2344,2348],{"type":42,"tag":237,"props":2336,"children":2337},{"style":1709},[2338],{"type":47,"value":2339},"      echo",{"type":42,"tag":237,"props":2341,"children":2342},{"style":243},[2343],{"type":47,"value":276},{"type":42,"tag":237,"props":2345,"children":2346},{"style":459},[2347],{"type":47,"value":2186},{"type":42,"tag":237,"props":2349,"children":2350},{"style":243},[2351],{"type":47,"value":1211},{"type":42,"tag":237,"props":2353,"children":2354},{"class":239,"line":1031},[2355],{"type":42,"tag":237,"props":2356,"children":2357},{"style":1758},[2358],{"type":47,"value":2359},"      break\n",{"type":42,"tag":237,"props":2361,"children":2362},{"class":239,"line":1056},[2363],{"type":42,"tag":237,"props":2364,"children":2365},{"style":1758},[2366],{"type":47,"value":2367},"    fi\n",{"type":42,"tag":237,"props":2369,"children":2370},{"class":239,"line":1081},[2371],{"type":42,"tag":237,"props":2372,"children":2373},{"style":1758},[2374],{"type":47,"value":2375},"  fi\n",{"type":42,"tag":237,"props":2377,"children":2378},{"class":239,"line":1106},[2379,2384],{"type":42,"tag":237,"props":2380,"children":2381},{"style":504},[2382],{"type":47,"value":2383},"  sleep",{"type":42,"tag":237,"props":2385,"children":2386},{"style":315},[2387],{"type":47,"value":2388}," 5\n",{"type":42,"tag":237,"props":2390,"children":2391},{"class":239,"line":1132},[2392],{"type":42,"tag":237,"props":2393,"children":2394},{"style":1758},[2395],{"type":47,"value":2396},"done\n",{"type":42,"tag":50,"props":2398,"children":2399},{},[2400,2402,2408,2410,2416,2418,2423],{"type":47,"value":2401},"If no response in 3 min, fail the stage with ",{"type":42,"tag":107,"props":2403,"children":2405},{"className":2404},[],[2406],{"type":47,"value":2407},"status: \"failed\"",{"type":47,"value":2409}," + ",{"type":42,"tag":107,"props":2411,"children":2413},{"className":2412},[],[2414],{"type":47,"value":2415},"notes: \"triage worker did not respond\"",{"type":47,"value":2417},". Don't block the pipeline — move to Stage 2 with the fingerprint fields set to ",{"type":42,"tag":107,"props":2419,"children":2421},{"className":2420},[],[2422],{"type":47,"value":1994},{"type":47,"value":2424},".",{"type":42,"tag":1228,"props":2426,"children":2428},{"id":2427},"_4-write-envelope-to-ddb",[2429],{"type":47,"value":2430},"4. Write envelope to DDB",{"type":42,"tag":226,"props":2432,"children":2434},{"className":1236,"code":2433,"language":1238,"meta":231,"style":231},"TS=$(date -u +%s)\naws dynamodb put-item --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --item \"$(jq -n --arg a \"$ARTIFACT_ID\" --arg sk \"triage#$TS\" --argjson findings \"$BODY\" \\\n    '{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"triage\"}, status:{S:\"ok\"}, findings:{S:($findings|tostring)}}')\"\n",[2435],{"type":42,"tag":107,"props":2436,"children":2437},{"__ignoreMap":231},[2438,2467,2495,2518,2597],{"type":42,"tag":237,"props":2439,"children":2440},{"class":239,"line":26},[2441,2446,2450,2454,2459,2463],{"type":42,"tag":237,"props":2442,"children":2443},{"style":459},[2444],{"type":47,"value":2445},"TS",{"type":42,"tag":237,"props":2447,"children":2448},{"style":243},[2449],{"type":47,"value":1434},{"type":42,"tag":237,"props":2451,"children":2452},{"style":504},[2453],{"type":47,"value":1546},{"type":42,"tag":237,"props":2455,"children":2456},{"style":279},[2457],{"type":47,"value":2458}," -u",{"type":42,"tag":237,"props":2460,"children":2461},{"style":279},[2462],{"type":47,"value":1551},{"type":42,"tag":237,"props":2464,"children":2465},{"style":243},[2466],{"type":47,"value":1703},{"type":42,"tag":237,"props":2468,"children":2469},{"class":239,"line":249},[2470,2474,2478,2483,2487,2491],{"type":42,"tag":237,"props":2471,"children":2472},{"style":504},[2473],{"type":47,"value":1250},{"type":42,"tag":237,"props":2475,"children":2476},{"style":279},[2477],{"type":47,"value":1255},{"type":42,"tag":237,"props":2479,"children":2480},{"style":279},[2481],{"type":47,"value":2482}," put-item",{"type":42,"tag":237,"props":2484,"children":2485},{"style":279},[2486],{"type":47,"value":1265},{"type":42,"tag":237,"props":2488,"children":2489},{"style":279},[2490],{"type":47,"value":1270},{"type":42,"tag":237,"props":2492,"children":2493},{"style":459},[2494],{"type":47,"value":1275},{"type":42,"tag":237,"props":2496,"children":2497},{"class":239,"line":294},[2498,2502,2506,2510,2514],{"type":42,"tag":237,"props":2499,"children":2500},{"style":279},[2501],{"type":47,"value":1283},{"type":42,"tag":237,"props":2503,"children":2504},{"style":243},[2505],{"type":47,"value":276},{"type":42,"tag":237,"props":2507,"children":2508},{"style":459},[2509],{"type":47,"value":1292},{"type":42,"tag":237,"props":2511,"children":2512},{"style":243},[2513],{"type":47,"value":266},{"type":42,"tag":237,"props":2515,"children":2516},{"style":459},[2517],{"type":47,"value":1275},{"type":42,"tag":237,"props":2519,"children":2520},{"class":239,"line":325},[2521,2526,2531,2536,2541,2545,2549,2553,2558,2562,2567,2572,2576,2581,2585,2589,2593],{"type":42,"tag":237,"props":2522,"children":2523},{"style":279},[2524],{"type":47,"value":2525},"  --item",{"type":42,"tag":237,"props":2527,"children":2528},{"style":243},[2529],{"type":47,"value":2530}," \"$(",{"type":42,"tag":237,"props":2532,"children":2533},{"style":504},[2534],{"type":47,"value":2535},"jq",{"type":42,"tag":237,"props":2537,"children":2538},{"style":279},[2539],{"type":47,"value":2540}," -n --arg a ",{"type":42,"tag":237,"props":2542,"children":2543},{"style":243},[2544],{"type":47,"value":266},{"type":42,"tag":237,"props":2546,"children":2547},{"style":459},[2548],{"type":47,"value":1353},{"type":42,"tag":237,"props":2550,"children":2551},{"style":243},[2552],{"type":47,"value":266},{"type":42,"tag":237,"props":2554,"children":2555},{"style":279},[2556],{"type":47,"value":2557}," --arg sk ",{"type":42,"tag":237,"props":2559,"children":2560},{"style":243},[2561],{"type":47,"value":266},{"type":42,"tag":237,"props":2563,"children":2564},{"style":279},[2565],{"type":47,"value":2566},"triage#",{"type":42,"tag":237,"props":2568,"children":2569},{"style":459},[2570],{"type":47,"value":2571},"$TS",{"type":42,"tag":237,"props":2573,"children":2574},{"style":243},[2575],{"type":47,"value":266},{"type":42,"tag":237,"props":2577,"children":2578},{"style":279},[2579],{"type":47,"value":2580}," --argjson findings ",{"type":42,"tag":237,"props":2582,"children":2583},{"style":243},[2584],{"type":47,"value":266},{"type":42,"tag":237,"props":2586,"children":2587},{"style":459},[2588],{"type":47,"value":2186},{"type":42,"tag":237,"props":2590,"children":2591},{"style":243},[2592],{"type":47,"value":266},{"type":42,"tag":237,"props":2594,"children":2595},{"style":459},[2596],{"type":47,"value":1275},{"type":42,"tag":237,"props":2598,"children":2599},{"class":239,"line":362},[2600,2605,2610],{"type":42,"tag":237,"props":2601,"children":2602},{"style":243},[2603],{"type":47,"value":2604},"    '",{"type":42,"tag":237,"props":2606,"children":2607},{"style":279},[2608],{"type":47,"value":2609},"{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"triage\"}, status:{S:\"ok\"}, findings:{S:($findings|tostring)}}",{"type":42,"tag":237,"props":2611,"children":2612},{"style":243},[2613],{"type":47,"value":2614},"')\"\n",{"type":42,"tag":1228,"props":2616,"children":2618},{"id":2617},"_5-post-stage-comment-to-the-issue",[2619],{"type":47,"value":2620},"5. Post stage comment to the issue",{"type":42,"tag":50,"props":2622,"children":2623},{},[2624,2626,2632,2634,2640],{"type":47,"value":2625},"Use the ",{"type":42,"tag":107,"props":2627,"children":2629},{"className":2628},[],[2630],{"type":47,"value":2631},"issue-comment",{"type":47,"value":2633}," skill (or invoke ",{"type":42,"tag":107,"props":2635,"children":2637},{"className":2636},[],[2638],{"type":47,"value":2639},"gh issue comment",{"type":47,"value":2641}," directly) with:",{"type":42,"tag":226,"props":2643,"children":2647},{"className":2644,"code":2645,"language":2646,"meta":231,"style":231},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Stage 1 — Triage\n\n**Status**: ✅ complete | ⚠️ partial | ❌ failed\n\n| Hash | Value |\n|------|-------|\n| MD5 | `\u003Cmd5>` |\n| SHA1 | `\u003Csha1>` |\n| SHA256 | `\u003Csha256>` |\n\n- **File type (file)**: ...\n- **File type (magika)**: ...\n- **Disagreement?**: yes\u002Fno — _if yes, flag it as a signal_\n- **Compile timestamp**: ...\n- **Signature**: valid \u002F unsigned \u002F invalid\n- **High-entropy sections** (>7.0): ...\n\n**Candidate IOCs** (for Stage 2):\n- Domains: ...\n- IPs: ...\n- URLs: ...\n\n\u003Cdetails>\u003Csummary>Full JSON\u003C\u002Fsummary>\n\n```json\n{...full envelope...}\n","markdown",[2648],{"type":42,"tag":107,"props":2649,"children":2650},{"__ignoreMap":231},[2651,2664,2671,2695,2702,2728,2736,2772,2805,2838,2845,2872,2896,2937,2961,2986,3011,3018,3039,3051,3063,3075,3082,3090,3097,3111],{"type":42,"tag":237,"props":2652,"children":2653},{"class":239,"line":26},[2654,2659],{"type":42,"tag":237,"props":2655,"children":2656},{"style":243},[2657],{"type":47,"value":2658},"## ",{"type":42,"tag":237,"props":2660,"children":2661},{"style":504},[2662],{"type":47,"value":2663},"Stage 1 — Triage\n",{"type":42,"tag":237,"props":2665,"children":2666},{"class":239,"line":249},[2667],{"type":42,"tag":237,"props":2668,"children":2669},{"emptyLinePlaceholder":1952},[2670],{"type":47,"value":1955},{"type":42,"tag":237,"props":2672,"children":2673},{"class":239,"line":294},[2674,2680,2686,2690],{"type":42,"tag":237,"props":2675,"children":2677},{"style":2676},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2678],{"type":47,"value":2679},"**",{"type":42,"tag":237,"props":2681,"children":2683},{"style":2682},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2684],{"type":47,"value":2685},"Status",{"type":42,"tag":237,"props":2687,"children":2688},{"style":2676},[2689],{"type":47,"value":2679},{"type":42,"tag":237,"props":2691,"children":2692},{"style":459},[2693],{"type":47,"value":2694},": ✅ complete | ⚠️ partial | ❌ failed\n",{"type":42,"tag":237,"props":2696,"children":2697},{"class":239,"line":325},[2698],{"type":42,"tag":237,"props":2699,"children":2700},{"emptyLinePlaceholder":1952},[2701],{"type":47,"value":1955},{"type":42,"tag":237,"props":2703,"children":2704},{"class":239,"line":362},[2705,2709,2714,2718,2723],{"type":42,"tag":237,"props":2706,"children":2707},{"style":243},[2708],{"type":47,"value":729},{"type":42,"tag":237,"props":2710,"children":2711},{"style":459},[2712],{"type":47,"value":2713}," Hash ",{"type":42,"tag":237,"props":2715,"children":2716},{"style":243},[2717],{"type":47,"value":729},{"type":42,"tag":237,"props":2719,"children":2720},{"style":459},[2721],{"type":47,"value":2722}," Value ",{"type":42,"tag":237,"props":2724,"children":2725},{"style":243},[2726],{"type":47,"value":2727},"|\n",{"type":42,"tag":237,"props":2729,"children":2730},{"class":239,"line":400},[2731],{"type":42,"tag":237,"props":2732,"children":2733},{"style":243},[2734],{"type":47,"value":2735},"|------|-------|\n",{"type":42,"tag":237,"props":2737,"children":2738},{"class":239,"line":438},[2739,2743,2748,2752,2757,2762,2767],{"type":42,"tag":237,"props":2740,"children":2741},{"style":243},[2742],{"type":47,"value":729},{"type":42,"tag":237,"props":2744,"children":2745},{"style":459},[2746],{"type":47,"value":2747}," MD5 ",{"type":42,"tag":237,"props":2749,"children":2750},{"style":243},[2751],{"type":47,"value":729},{"type":42,"tag":237,"props":2753,"children":2754},{"style":243},[2755],{"type":47,"value":2756}," `",{"type":42,"tag":237,"props":2758,"children":2759},{"style":279},[2760],{"type":47,"value":2761},"\u003Cmd5>",{"type":42,"tag":237,"props":2763,"children":2764},{"style":243},[2765],{"type":47,"value":2766},"`",{"type":42,"tag":237,"props":2768,"children":2769},{"style":243},[2770],{"type":47,"value":2771}," |\n",{"type":42,"tag":237,"props":2773,"children":2774},{"class":239,"line":469},[2775,2779,2784,2788,2792,2797,2801],{"type":42,"tag":237,"props":2776,"children":2777},{"style":243},[2778],{"type":47,"value":729},{"type":42,"tag":237,"props":2780,"children":2781},{"style":459},[2782],{"type":47,"value":2783}," SHA1 ",{"type":42,"tag":237,"props":2785,"children":2786},{"style":243},[2787],{"type":47,"value":729},{"type":42,"tag":237,"props":2789,"children":2790},{"style":243},[2791],{"type":47,"value":2756},{"type":42,"tag":237,"props":2793,"children":2794},{"style":279},[2795],{"type":47,"value":2796},"\u003Csha1>",{"type":42,"tag":237,"props":2798,"children":2799},{"style":243},[2800],{"type":47,"value":2766},{"type":42,"tag":237,"props":2802,"children":2803},{"style":243},[2804],{"type":47,"value":2771},{"type":42,"tag":237,"props":2806,"children":2807},{"class":239,"line":495},[2808,2812,2817,2821,2825,2830,2834],{"type":42,"tag":237,"props":2809,"children":2810},{"style":243},[2811],{"type":47,"value":729},{"type":42,"tag":237,"props":2813,"children":2814},{"style":459},[2815],{"type":47,"value":2816}," SHA256 ",{"type":42,"tag":237,"props":2818,"children":2819},{"style":243},[2820],{"type":47,"value":729},{"type":42,"tag":237,"props":2822,"children":2823},{"style":243},[2824],{"type":47,"value":2756},{"type":42,"tag":237,"props":2826,"children":2827},{"style":279},[2828],{"type":47,"value":2829},"\u003Csha256>",{"type":42,"tag":237,"props":2831,"children":2832},{"style":243},[2833],{"type":47,"value":2766},{"type":42,"tag":237,"props":2835,"children":2836},{"style":243},[2837],{"type":47,"value":2771},{"type":42,"tag":237,"props":2839,"children":2840},{"class":239,"line":625},[2841],{"type":42,"tag":237,"props":2842,"children":2843},{"emptyLinePlaceholder":1952},[2844],{"type":47,"value":1955},{"type":42,"tag":237,"props":2846,"children":2847},{"class":239,"line":663},[2848,2853,2858,2863,2867],{"type":42,"tag":237,"props":2849,"children":2850},{"style":243},[2851],{"type":47,"value":2852},"-",{"type":42,"tag":237,"props":2854,"children":2855},{"style":2676},[2856],{"type":47,"value":2857}," **",{"type":42,"tag":237,"props":2859,"children":2860},{"style":2682},[2861],{"type":47,"value":2862},"File type (file)",{"type":42,"tag":237,"props":2864,"children":2865},{"style":2676},[2866],{"type":47,"value":2679},{"type":42,"tag":237,"props":2868,"children":2869},{"style":459},[2870],{"type":47,"value":2871},": ...\n",{"type":42,"tag":237,"props":2873,"children":2874},{"class":239,"line":701},[2875,2879,2883,2888,2892],{"type":42,"tag":237,"props":2876,"children":2877},{"style":243},[2878],{"type":47,"value":2852},{"type":42,"tag":237,"props":2880,"children":2881},{"style":2676},[2882],{"type":47,"value":2857},{"type":42,"tag":237,"props":2884,"children":2885},{"style":2682},[2886],{"type":47,"value":2887},"File type (magika)",{"type":42,"tag":237,"props":2889,"children":2890},{"style":2676},[2891],{"type":47,"value":2679},{"type":42,"tag":237,"props":2893,"children":2894},{"style":459},[2895],{"type":47,"value":2871},{"type":42,"tag":237,"props":2897,"children":2898},{"class":239,"line":737},[2899,2903,2907,2912,2916,2921,2926,2932],{"type":42,"tag":237,"props":2900,"children":2901},{"style":243},[2902],{"type":47,"value":2852},{"type":42,"tag":237,"props":2904,"children":2905},{"style":2676},[2906],{"type":47,"value":2857},{"type":42,"tag":237,"props":2908,"children":2909},{"style":2682},[2910],{"type":47,"value":2911},"Disagreement?",{"type":42,"tag":237,"props":2913,"children":2914},{"style":2676},[2915],{"type":47,"value":2679},{"type":42,"tag":237,"props":2917,"children":2918},{"style":459},[2919],{"type":47,"value":2920},": yes\u002Fno — ",{"type":42,"tag":237,"props":2922,"children":2923},{"style":1758},[2924],{"type":47,"value":2925},"_",{"type":42,"tag":237,"props":2927,"children":2929},{"style":2928},"--shiki-light:#E53935;--shiki-light-font-style:italic;--shiki-default:#F07178;--shiki-default-font-style:italic;--shiki-dark:#F07178;--shiki-dark-font-style:italic",[2930],{"type":47,"value":2931},"if yes, flag it as a signal",{"type":42,"tag":237,"props":2933,"children":2934},{"style":1758},[2935],{"type":47,"value":2936},"_\n",{"type":42,"tag":237,"props":2938,"children":2939},{"class":239,"line":775},[2940,2944,2948,2953,2957],{"type":42,"tag":237,"props":2941,"children":2942},{"style":243},[2943],{"type":47,"value":2852},{"type":42,"tag":237,"props":2945,"children":2946},{"style":2676},[2947],{"type":47,"value":2857},{"type":42,"tag":237,"props":2949,"children":2950},{"style":2682},[2951],{"type":47,"value":2952},"Compile timestamp",{"type":42,"tag":237,"props":2954,"children":2955},{"style":2676},[2956],{"type":47,"value":2679},{"type":42,"tag":237,"props":2958,"children":2959},{"style":459},[2960],{"type":47,"value":2871},{"type":42,"tag":237,"props":2962,"children":2963},{"class":239,"line":813},[2964,2968,2972,2977,2981],{"type":42,"tag":237,"props":2965,"children":2966},{"style":243},[2967],{"type":47,"value":2852},{"type":42,"tag":237,"props":2969,"children":2970},{"style":2676},[2971],{"type":47,"value":2857},{"type":42,"tag":237,"props":2973,"children":2974},{"style":2682},[2975],{"type":47,"value":2976},"Signature",{"type":42,"tag":237,"props":2978,"children":2979},{"style":2676},[2980],{"type":47,"value":2679},{"type":42,"tag":237,"props":2982,"children":2983},{"style":459},[2984],{"type":47,"value":2985},": valid \u002F unsigned \u002F invalid\n",{"type":42,"tag":237,"props":2987,"children":2988},{"class":239,"line":920},[2989,2993,2997,3002,3006],{"type":42,"tag":237,"props":2990,"children":2991},{"style":243},[2992],{"type":47,"value":2852},{"type":42,"tag":237,"props":2994,"children":2995},{"style":2676},[2996],{"type":47,"value":2857},{"type":42,"tag":237,"props":2998,"children":2999},{"style":2682},[3000],{"type":47,"value":3001},"High-entropy sections",{"type":42,"tag":237,"props":3003,"children":3004},{"style":2676},[3005],{"type":47,"value":2679},{"type":42,"tag":237,"props":3007,"children":3008},{"style":459},[3009],{"type":47,"value":3010}," (>7.0): ...\n",{"type":42,"tag":237,"props":3012,"children":3013},{"class":239,"line":979},[3014],{"type":42,"tag":237,"props":3015,"children":3016},{"emptyLinePlaceholder":1952},[3017],{"type":47,"value":1955},{"type":42,"tag":237,"props":3019,"children":3020},{"class":239,"line":1004},[3021,3025,3030,3034],{"type":42,"tag":237,"props":3022,"children":3023},{"style":2676},[3024],{"type":47,"value":2679},{"type":42,"tag":237,"props":3026,"children":3027},{"style":2682},[3028],{"type":47,"value":3029},"Candidate IOCs",{"type":42,"tag":237,"props":3031,"children":3032},{"style":2676},[3033],{"type":47,"value":2679},{"type":42,"tag":237,"props":3035,"children":3036},{"style":459},[3037],{"type":47,"value":3038}," (for Stage 2):\n",{"type":42,"tag":237,"props":3040,"children":3041},{"class":239,"line":1031},[3042,3046],{"type":42,"tag":237,"props":3043,"children":3044},{"style":243},[3045],{"type":47,"value":2852},{"type":42,"tag":237,"props":3047,"children":3048},{"style":459},[3049],{"type":47,"value":3050}," Domains: ...\n",{"type":42,"tag":237,"props":3052,"children":3053},{"class":239,"line":1056},[3054,3058],{"type":42,"tag":237,"props":3055,"children":3056},{"style":243},[3057],{"type":47,"value":2852},{"type":42,"tag":237,"props":3059,"children":3060},{"style":459},[3061],{"type":47,"value":3062}," IPs: ...\n",{"type":42,"tag":237,"props":3064,"children":3065},{"class":239,"line":1081},[3066,3070],{"type":42,"tag":237,"props":3067,"children":3068},{"style":243},[3069],{"type":47,"value":2852},{"type":42,"tag":237,"props":3071,"children":3072},{"style":459},[3073],{"type":47,"value":3074}," URLs: ...\n",{"type":42,"tag":237,"props":3076,"children":3077},{"class":239,"line":1106},[3078],{"type":42,"tag":237,"props":3079,"children":3080},{"emptyLinePlaceholder":1952},[3081],{"type":47,"value":1955},{"type":42,"tag":237,"props":3083,"children":3084},{"class":239,"line":1132},[3085],{"type":42,"tag":237,"props":3086,"children":3087},{"style":459},[3088],{"type":47,"value":3089},"\u003Cdetails>\u003Csummary>Full JSON\u003C\u002Fsummary>\n",{"type":42,"tag":237,"props":3091,"children":3092},{"class":239,"line":1141},[3093],{"type":42,"tag":237,"props":3094,"children":3095},{"emptyLinePlaceholder":1952},[3096],{"type":47,"value":1955},{"type":42,"tag":237,"props":3098,"children":3099},{"class":239,"line":1150},[3100,3105],{"type":42,"tag":237,"props":3101,"children":3102},{"style":279},[3103],{"type":47,"value":3104},"```",{"type":42,"tag":237,"props":3106,"children":3108},{"style":3107},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[3109],{"type":47,"value":3110},"json\n",{"type":42,"tag":237,"props":3112,"children":3113},{"class":239,"line":1179},[3114,3118,3123],{"type":42,"tag":237,"props":3115,"children":3116},{"style":243},[3117],{"type":47,"value":1577},{"type":42,"tag":237,"props":3119,"children":3120},{"style":459},[3121],{"type":47,"value":3122},"...full envelope...",{"type":42,"tag":237,"props":3124,"children":3125},{"style":243},[3126],{"type":47,"value":1220},{"type":42,"tag":61,"props":3128,"children":3130},{"id":3129},"failure-handling",[3131],{"type":47,"value":3132},"Failure handling",{"type":42,"tag":3134,"props":3135,"children":3136},"ul",{},[3137,3143,3156,3169],{"type":42,"tag":3138,"props":3139,"children":3140},"li",{},[3141],{"type":47,"value":3142},"Queue send fails → retry 3× with 5s backoff, then fail the stage",{"type":42,"tag":3138,"props":3144,"children":3145},{},[3146,3148,3154],{"type":47,"value":3147},"No response in 3 min → mark stage ",{"type":42,"tag":107,"props":3149,"children":3151},{"className":3150},[],[3152],{"type":47,"value":3153},"failed",{"type":47,"value":3155},", proceed to Stage 2 with null fingerprint",{"type":42,"tag":3138,"props":3157,"children":3158},{},[3159,3161,3167],{"type":47,"value":3160},"DDB write fails → retry 3×, then write envelope to S3 at ",{"type":42,"tag":107,"props":3162,"children":3164},{"className":3163},[],[3165],{"type":47,"value":3166},"s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\u002Fstage-1-triage.json",{"type":47,"value":3168}," as fallback",{"type":42,"tag":3138,"props":3170,"children":3171},{},[3172],{"type":47,"value":3173},"GH comment fails → retry 3×, then continue (don't block pipeline on comment failures)",{"type":42,"tag":61,"props":3175,"children":3177},{"id":3176},"guardrails",[3178],{"type":47,"value":3179},"Guardrails",{"type":42,"tag":3134,"props":3181,"children":3182},{},[3183,3188,3193],{"type":42,"tag":3138,"props":3184,"children":3185},{},[3186],{"type":47,"value":3187},"The sandboxed worker handles sample bytes; your skill only passes an S3 URI over SQS. Keeping bytes out of this pod is what preserves the blast-radius boundary between the main cluster and the Threat Research VPC.",{"type":42,"tag":3138,"props":3189,"children":3190},{},[3191],{"type":47,"value":3192},"Publish the stage comment before moving to Stage 2. Users watch these comments stream in as the pipeline runs; a skipped comment looks like a stall.",{"type":42,"tag":3138,"props":3194,"children":3195},{},[3196,3198,3203],{"type":47,"value":3197},"Reuse cached envelopes when ",{"type":42,"tag":107,"props":3199,"children":3201},{"className":3200},[],[3202],{"type":47,"value":261},{"type":47,"value":3204}," was seen recently. Re-queueing wastes worker time and produces duplicate DDB rows that Stage 7's report assembly then has to deduplicate.",{"type":42,"tag":3206,"props":3207,"children":3208},"style",{},[3209],{"type":47,"value":3210},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3212,"total":3389},[3213,3231,3252,3262,3275,3288,3298,3308,3329,3344,3359,3374],{"slug":3214,"name":3214,"fn":3215,"description":3216,"org":3217,"tags":3218,"stars":3228,"repoUrl":3229,"updatedAt":3230},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3219,3221,3222,3225],{"name":3220,"slug":1250,"type":16},"AWS",{"name":24,"slug":25,"type":16},{"name":3223,"slug":3224,"type":16},"Logs","logs",{"name":3226,"slug":3227,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":3232,"name":3233,"fn":3234,"description":3235,"org":3236,"tags":3237,"stars":3228,"repoUrl":3229,"updatedAt":3251},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3238,3241,3242,3245,3248],{"name":3239,"slug":3240,"type":16},"Aurora","aurora",{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},"Database","database",{"name":3246,"slug":3247,"type":16},"Serverless","serverless",{"name":3249,"slug":3250,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":3253,"name":3254,"fn":3234,"description":3235,"org":3255,"tags":3256,"stars":3228,"repoUrl":3229,"updatedAt":3261},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3257,3258,3259,3260],{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},{"name":3246,"slug":3247,"type":16},{"name":3249,"slug":3250,"type":16},"2026-08-04T05:35:05.694395",{"slug":3263,"name":3264,"fn":3234,"description":3235,"org":3265,"tags":3266,"stars":3228,"repoUrl":3229,"updatedAt":3274},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3267,3268,3269,3272,3273],{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},{"name":3270,"slug":3271,"type":16},"Migration","migration",{"name":3246,"slug":3247,"type":16},{"name":3249,"slug":3250,"type":16},"2026-08-04T05:35:08.749669",{"slug":3276,"name":3277,"fn":3234,"description":3235,"org":3278,"tags":3279,"stars":3228,"repoUrl":3229,"updatedAt":3287},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3280,3281,3282,3285,3286],{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},{"name":3283,"slug":3284,"type":16},"PostgreSQL","postgresql",{"name":3246,"slug":3247,"type":16},{"name":3249,"slug":3250,"type":16},"2026-08-04T05:35:06.713102",{"slug":3289,"name":3290,"fn":3234,"description":3235,"org":3291,"tags":3292,"stars":3228,"repoUrl":3229,"updatedAt":3297},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3293,3294,3295,3296],{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},{"name":3246,"slug":3247,"type":16},{"name":3249,"slug":3250,"type":16},"2026-08-04T05:35:10.086942",{"slug":3299,"name":3299,"fn":3234,"description":3235,"org":3300,"tags":3301,"stars":3228,"repoUrl":3229,"updatedAt":3307},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3302,3303,3304,3305,3306],{"name":3220,"slug":1250,"type":16},{"name":3243,"slug":3244,"type":16},{"name":3270,"slug":3271,"type":16},{"name":3246,"slug":3247,"type":16},{"name":3249,"slug":3250,"type":16},"2026-08-04T05:35:07.751779",{"slug":3309,"name":3309,"fn":3310,"description":3311,"org":3312,"tags":3313,"stars":3326,"repoUrl":3327,"updatedAt":3328},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3314,3317,3320,3323],{"name":3315,"slug":3316,"type":16},"Accounting","accounting",{"name":3318,"slug":3319,"type":16},"Analytics","analytics",{"name":3321,"slug":3322,"type":16},"Cost Optimization","cost-optimization",{"name":3324,"slug":3325,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":3330,"name":3330,"fn":3331,"description":3332,"org":3333,"tags":3334,"stars":3326,"repoUrl":3327,"updatedAt":3343},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3335,3336,3337,3340],{"name":3220,"slug":1250,"type":16},{"name":3324,"slug":3325,"type":16},{"name":3338,"slug":3339,"type":16},"Management","management",{"name":3341,"slug":3342,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":3345,"name":3345,"fn":3346,"description":3347,"org":3348,"tags":3349,"stars":3326,"repoUrl":3327,"updatedAt":3358},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3350,3351,3352,3355],{"name":3318,"slug":3319,"type":16},{"name":3324,"slug":3325,"type":16},{"name":3353,"slug":3354,"type":16},"Financial Statements","financial-statements",{"name":3356,"slug":3357,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":3360,"name":3360,"fn":3361,"description":3362,"org":3363,"tags":3364,"stars":3326,"repoUrl":3327,"updatedAt":3373},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3365,3368,3371],{"name":3366,"slug":3367,"type":16},"Automation","automation",{"name":3369,"slug":3370,"type":16},"Documents","documents",{"name":3372,"slug":3360,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":3375,"name":3375,"fn":3376,"description":3377,"org":3378,"tags":3379,"stars":3326,"repoUrl":3327,"updatedAt":3388},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3380,3381,3384,3385],{"name":3315,"slug":3316,"type":16},{"name":3382,"slug":3383,"type":16},"Data Analysis","data-analysis",{"name":3324,"slug":3325,"type":16},{"name":3386,"slug":3387,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",155,{"items":3391,"total":362},[3392,3399,3414,3432,3449],{"slug":4,"name":4,"fn":5,"description":6,"org":3393,"tags":3394,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3395,3396,3397,3398],{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},{"slug":3400,"name":3400,"fn":3401,"description":3402,"org":3403,"tags":3404,"stars":26,"repoUrl":27,"updatedAt":3413},"stage-5-correlation","correlate dynamic findings with threat intelligence","Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3405,3408,3409,3410],{"name":3406,"slug":3407,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":3411,"slug":3412,"type":16},"Threat Modeling","threat-modeling","2026-08-04T05:59:09.270695",{"slug":3415,"name":3415,"fn":3416,"description":3417,"org":3418,"tags":3419,"stars":26,"repoUrl":27,"updatedAt":3431},"stage-6-verdict","synthesize security verdicts and recommended actions","Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3420,3421,3424,3427,3430],{"name":3406,"slug":3407,"type":16},{"name":3422,"slug":3423,"type":16},"Compliance","compliance",{"name":3425,"slug":3426,"type":16},"Incident Response","incident-response",{"name":3428,"slug":3429,"type":16},"Policy","policy",{"name":14,"slug":15,"type":16},"2026-08-04T05:59:08.753662",{"slug":3433,"name":3433,"fn":3434,"description":3435,"org":3436,"tags":3437,"stars":26,"repoUrl":27,"updatedAt":3448},"stage-7-report","generate security incident reports and IOC feeds","Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3438,3439,3440,3443,3444,3445],{"name":3406,"slug":3407,"type":16},{"name":3422,"slug":3423,"type":16},{"name":3441,"slug":3442,"type":16},"Elastic","elastic",{"name":3341,"slug":3342,"type":16},{"name":14,"slug":15,"type":16},{"name":3446,"slug":3447,"type":16},"Splunk","splunk","2026-08-04T05:59:08.226613",{"slug":3450,"name":3450,"fn":3451,"description":3452,"org":3453,"tags":3454,"stars":26,"repoUrl":27,"updatedAt":3462},"url-analysis","analyze suspicious URLs in isolated browser sessions","Analyze a suspicious URL by visiting it in an isolated AgentCore Browser\nsession. Captures screenshots, DOM, network requests, redirects, and\nextracted IOCs. Use for phishing triage, suspicious-link investigation,\nand malicious-site fingerprinting.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3455,3458,3459,3460,3461],{"name":3456,"slug":3457,"type":16},"Browser Automation","browser-automation",{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},"2026-08-04T05:58:51.393402"]