[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-stage-7-report":3,"mdc--iah7mq-key":42,"related-repo-aws-labs-stage-7-report":2319,"related-org-aws-labs-stage-7-report":2390},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":32,"repoUrl":33,"updatedAt":34,"license":35,"forks":36,"topics":37,"repo":38,"sourceUrl":40,"mdContent":41},"stage-7-report","generate security incident reports and IOC feeds","Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23,26,29],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Compliance","compliance",{"name":21,"slug":22,"type":16},"Reporting","reporting",{"name":24,"slug":25,"type":16},"Audit","audit",{"name":27,"slug":28,"type":16},"Elastic","elastic",{"name":30,"slug":31,"type":16},"Splunk","splunk",1,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform","2026-08-04T05:59:08.226613",null,0,[],{"repoUrl":33,"stars":32,"forks":36,"topics":39,"description":35},[],"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentic-developer-platform\u002Ftree\u002FHEAD\u002Fmodules\u002Fdomain-apps\u002Fcyber\u002Fagent\u002Fskills\u002Fstage-7-report","---\nname: stage-7-report\ndescription: Produce the final deliverables — executive summary (for leadership), structured technical report (for IR), STIX 2.1 + CSV IOC feeds (for SIEM\u002Ffirewall), copy-pasteable Splunk\u002FElastic\u002FSentinel hunt queries — upload them all to S3 with presigned URLs, and post a single consolidated comment linking everything. Use this skill whenever the pipeline has reached a verdict (Stage 6 done) and the issue needs a handoff-ready set of artifacts for IR follow-up. Always the last stage; runs on benign short-circuits too (produces a concise clean-sample report).\n---\n\n# Stage 7 — Report\n\nFinal stage. Produces artifacts, uploads them, posts the links. No external calls except S3.\n\n## Inputs\n\nAll prior stage envelopes from DDB + Stage 6 verdict.\n\n## Outputs\n\nSet of files at `s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\u002F`:\n\n- `executive_summary.md` — 3-5 sentences for non-technical readers\n- `technical_report.md` — full structured report\n- `iocs.stix.json` — STIX 2.1 bundle\n- `iocs.csv` — CSV feed\n- `timeline.json` — Stage 4 timeline, if available\n- `hunt_queries.splunk.txt`\n- `hunt_queries.elastic.txt`\n- `hunt_queries.sentinel.txt`\n- `pipeline_envelope.json` — all 7 stage envelopes merged (for automation consumers)\n\nDDB final row with `status: \"reported\"` + `artifact_uris` list.\n\n## Steps\n\n### 1. Assemble the artifacts (all local temp)\n\n```bash\nWORKDIR=\u002Ftmp\u002Freport-$ARTIFACT_ID\nmkdir -p $WORKDIR\n```\n\n**executive_summary.md** — you write this. Non-technical. Example:\n\n```markdown\n# Analysis of \u003Cfilename> (\u003Csha256_short>) — 2026-04-29\n\n**Verdict**: Confirmed Qakbot v5.x banking trojan (high confidence).\n\nThe sample is an active malware loader that attempts to inject into\n`explorer.exe` and contact a known command-and-control server\n(`1.2.3.4`). On a compromised host, it would give the attacker the\nability to steal browser credentials and install additional payloads.\nRecommend immediate host isolation and perimeter block of the C2\ninfrastructure listed in the IOC feed.\n```\n\n**technical_report.md** — structured dump, one section per stage:\n\n```markdown\n# Technical Report — \u003Cartifact_id>\n\n## Metadata\n- Sample SHA256: ...\n- File type: ...\n- Analysis date: 2026-04-29T...\n- Pipeline run ID: ...\n\n## Stage 1 — Triage\n(quote Stage 1 envelope findings in human-readable form)\n\n## Stage 2 — OSINT recon\n...\n\n## Stage 3 — Static analysis\n...\n\n(etc., through Stage 6)\n\n## Appendix A — IOCs (see iocs.csv + iocs.stix.json for machine formats)\n| Type | Value | Source | Confidence |\n|---|---|---|---|\n\n## Appendix B — MITRE ATT&CK coverage\n| Technique | ID | Evidence |\n|---|---|---|\n```\n\n**iocs.stix.json** — copy Stage 6's STIX bundle verbatim.\n\n**iocs.csv** — copy Stage 6's CSV verbatim.\n\n**timeline.json** — Stage 4's event timeline if it exists, else empty `[]`.\n\n**hunt_queries.splunk.txt** — use the template:\n\n```\nindex=* (hash=\u003Csha256> OR hash=\u003Cmd5>)\nindex=* dest_ip IN (1.2.3.4)\nindex=sysmon EventCode=10 TargetImage=\"*explorer.exe\" GrantedAccess=\"0x1FFFFF\"\nindex=sysmon EventCode=13 TargetObject=\"*\\\\CurrentVersion\\\\Run\\\\*\" Image=\"\u003Cprocess>\"\n```\n\n**hunt_queries.elastic.txt**:\n\n```\nhash:(\"\u003Csha256>\" OR \"\u003Cmd5>\") OR destination.ip:\"1.2.3.4\"\nprocess.name:explorer.exe AND event.code:10 AND winlog.event_data.GrantedAccess:\"0x1FFFFF\"\n```\n\n**hunt_queries.sentinel.txt** (KQL):\n\n```kusto\nDeviceFileEvents | where SHA256 == \"...\"\nDeviceNetworkEvents | where RemoteIP == \"1.2.3.4\"\nDeviceProcessEvents | where InitiatingProcessFileName == \"explorer.exe\"\n```\n\n**pipeline_envelope.json** — merge all DDB rows for this artifact_id:\n\n```bash\naws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"}}' \\\n  --query 'Items' --output json > $WORKDIR\u002Fpipeline_envelope.json\n```\n\n### 2. Upload everything to S3\n\n```bash\nS3_PREFIX=\"s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\"\naws s3 sync $WORKDIR\u002F \"$S3_PREFIX\u002F\" --region us-east-1\n```\n\n### 3. Generate presigned URLs (7-day expiry)\n\n```bash\nfor f in $WORKDIR\u002F*; do\n  NAME=$(basename \"$f\")\n  URL=$(aws s3 presign \"$S3_PREFIX\u002F$NAME\" --expires-in 604800 --region us-east-1)\n  echo \"$NAME → $URL\"\ndone\n```\n\n### 4. Write final DDB envelope\n\n```bash\naws dynamodb put-item --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --item \"$(jq -n --arg a \"$ARTIFACT_ID\" --arg sk \"report#$(date -u +%s)\" --arg s3 \"$S3_PREFIX\" \\\n    '{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"report\"}, status:{S:\"reported\"}, s3_prefix:{S:$s3}}')\"\n```\n\n### 5. Publish final comment\n\n```markdown\n## Stage 7 — Report 📋\n\n**Analysis complete.** Total pipeline wall time: 23m 14s | Model: claude-opus-4-6 | Tool calls: 42\n\n### Executive summary\n> \u003Ccopy executive_summary.md content inline — 3-5 sentences>\n\n### Verdict\n🔴 **MALICIOUS** — high confidence — Qakbot v5.x\n\n### Artifacts\n- [Executive summary](\u003Cpresigned>) — 1 KB, 3-5 sentences\n- [Technical report](\u003Cpresigned>) — full structured report\n- [IOCs STIX 2.1](\u003Cpresigned>) — machine-readable feed\n- [IOCs CSV](\u003Cpresigned>) — spreadsheet-friendly\n- [Timeline JSON](\u003Cpresigned>) — event sequence from CAPE\n- [Splunk hunt queries](\u003Cpresigned>)\n- [Elastic hunt queries](\u003Cpresigned>)\n- [Sentinel KQL queries](\u003Cpresigned>)\n- [Full pipeline envelope](\u003Cpresigned>) — all 7 stage outputs merged\n\nAll links expire in 7 days.\n\n### Stage-by-stage comments\n- [Stage 1 — Triage](#)\n- [Stage 2 — OSINT recon](#)\n- [Stage 3 — Static analysis](#)\n- [Stage 4 — Dynamic analysis](#)\n- [Stage 5 — Correlation](#)\n- [Stage 6 — Verdict](#)\n\nPipeline complete. Close the issue when findings have been acted on.\n```\n\n## Failure handling\n\n- S3 upload fails → retry each file individually; if persistent, fail the stage and post the files inline in the GH comment as fenced blocks (degraded delivery)\n- Presigned URL generation fails → post S3 URIs without presigned (`s3:\u002F\u002F...`) with a note that the user needs AWS access to download\n- DDB write fails → retry 3×, then continue (the artifacts are in S3, that's what matters)\n\n## Guardrails\n\n- Link every artifact in the comment. A user who sees \"executive_summary.md generated\" but no link has to dig through S3 themselves — and will ask \"is this even done?\" in a follow-up comment. Link them all.\n- Treat prior runs as immutable. If `artifact_id` is re-analyzed, write under `\u002Freports\u002F\u003Cartifact_id>\u002F\u003Ctimestamp>\u002F` rather than overwriting. Audit trail and chain-of-custody depend on historical reports staying reproducible.\n- Keep the executive summary to 5 sentences. Leadership reads it on a phone; any more and they ask their team to summarize the summary.\n- Fill hunt queries with actual IOCs before writing the files. A Splunk query with `hash=\u003Csha256>` left as a placeholder is net-negative — it gets pasted into production search and returns zero, which looks like \"nothing matches\" rather than a broken query.\n",{"data":43,"body":44},{"name":4,"description":6},{"type":45,"children":46},"root",[47,55,61,68,73,79,93,191,212,218,225,284,294,444,453,785,794,803,820,829,839,847,856,865,898,907,1092,1098,1197,1203,1392,1398,1564,1570,2228,2234,2260,2266,2313],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Stage 7 — Report",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Final stage. Produces artifacts, uploads them, posts the links. No external calls except S3.",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"inputs",[66],{"type":53,"value":67},"Inputs",{"type":48,"tag":56,"props":69,"children":70},{},[71],{"type":53,"value":72},"All prior stage envelopes from DDB + Stage 6 verdict.",{"type":48,"tag":62,"props":74,"children":76},{"id":75},"outputs",[77],{"type":53,"value":78},"Outputs",{"type":48,"tag":56,"props":80,"children":81},{},[82,84,91],{"type":53,"value":83},"Set of files at ",{"type":48,"tag":85,"props":86,"children":88},"code",{"className":87},[],[89],{"type":53,"value":90},"s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\u002F",{"type":53,"value":92},":",{"type":48,"tag":94,"props":95,"children":96},"ul",{},[97,109,120,131,142,153,162,171,180],{"type":48,"tag":98,"props":99,"children":100},"li",{},[101,107],{"type":48,"tag":85,"props":102,"children":104},{"className":103},[],[105],{"type":53,"value":106},"executive_summary.md",{"type":53,"value":108}," — 3-5 sentences for non-technical readers",{"type":48,"tag":98,"props":110,"children":111},{},[112,118],{"type":48,"tag":85,"props":113,"children":115},{"className":114},[],[116],{"type":53,"value":117},"technical_report.md",{"type":53,"value":119}," — full structured report",{"type":48,"tag":98,"props":121,"children":122},{},[123,129],{"type":48,"tag":85,"props":124,"children":126},{"className":125},[],[127],{"type":53,"value":128},"iocs.stix.json",{"type":53,"value":130}," — STIX 2.1 bundle",{"type":48,"tag":98,"props":132,"children":133},{},[134,140],{"type":48,"tag":85,"props":135,"children":137},{"className":136},[],[138],{"type":53,"value":139},"iocs.csv",{"type":53,"value":141}," — CSV feed",{"type":48,"tag":98,"props":143,"children":144},{},[145,151],{"type":48,"tag":85,"props":146,"children":148},{"className":147},[],[149],{"type":53,"value":150},"timeline.json",{"type":53,"value":152}," — Stage 4 timeline, if available",{"type":48,"tag":98,"props":154,"children":155},{},[156],{"type":48,"tag":85,"props":157,"children":159},{"className":158},[],[160],{"type":53,"value":161},"hunt_queries.splunk.txt",{"type":48,"tag":98,"props":163,"children":164},{},[165],{"type":48,"tag":85,"props":166,"children":168},{"className":167},[],[169],{"type":53,"value":170},"hunt_queries.elastic.txt",{"type":48,"tag":98,"props":172,"children":173},{},[174],{"type":48,"tag":85,"props":175,"children":177},{"className":176},[],[178],{"type":53,"value":179},"hunt_queries.sentinel.txt",{"type":48,"tag":98,"props":181,"children":182},{},[183,189],{"type":48,"tag":85,"props":184,"children":186},{"className":185},[],[187],{"type":53,"value":188},"pipeline_envelope.json",{"type":53,"value":190}," — all 7 stage envelopes merged (for automation consumers)",{"type":48,"tag":56,"props":192,"children":193},{},[194,196,202,204,210],{"type":53,"value":195},"DDB final row with ",{"type":48,"tag":85,"props":197,"children":199},{"className":198},[],[200],{"type":53,"value":201},"status: \"reported\"",{"type":53,"value":203}," + ",{"type":48,"tag":85,"props":205,"children":207},{"className":206},[],[208],{"type":53,"value":209},"artifact_uris",{"type":53,"value":211}," list.",{"type":48,"tag":62,"props":213,"children":215},{"id":214},"steps",[216],{"type":53,"value":217},"Steps",{"type":48,"tag":219,"props":220,"children":222},"h3",{"id":221},"_1-assemble-the-artifacts-all-local-temp",[223],{"type":53,"value":224},"1. Assemble the artifacts (all local temp)",{"type":48,"tag":226,"props":227,"children":232},"pre",{"className":228,"code":229,"language":230,"meta":231,"style":231},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","WORKDIR=\u002Ftmp\u002Freport-$ARTIFACT_ID\nmkdir -p $WORKDIR\n","bash","",[233],{"type":48,"tag":85,"props":234,"children":235},{"__ignoreMap":231},[236,264],{"type":48,"tag":237,"props":238,"children":240},"span",{"class":239,"line":32},"line",[241,247,253,259],{"type":48,"tag":237,"props":242,"children":244},{"style":243},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[245],{"type":53,"value":246},"WORKDIR",{"type":48,"tag":237,"props":248,"children":250},{"style":249},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[251],{"type":53,"value":252},"=",{"type":48,"tag":237,"props":254,"children":256},{"style":255},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[257],{"type":53,"value":258},"\u002Ftmp\u002Freport-",{"type":48,"tag":237,"props":260,"children":261},{"style":243},[262],{"type":53,"value":263},"$ARTIFACT_ID\n",{"type":48,"tag":237,"props":265,"children":267},{"class":239,"line":266},2,[268,274,279],{"type":48,"tag":237,"props":269,"children":271},{"style":270},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[272],{"type":53,"value":273},"mkdir",{"type":48,"tag":237,"props":275,"children":276},{"style":255},[277],{"type":53,"value":278}," -p",{"type":48,"tag":237,"props":280,"children":281},{"style":243},[282],{"type":53,"value":283}," $WORKDIR\n",{"type":48,"tag":56,"props":285,"children":286},{},[287,292],{"type":48,"tag":288,"props":289,"children":290},"strong",{},[291],{"type":53,"value":106},{"type":53,"value":293}," — you write this. Non-technical. Example:",{"type":48,"tag":226,"props":295,"children":299},{"className":296,"code":297,"language":298,"meta":231,"style":231},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Analysis of \u003Cfilename> (\u003Csha256_short>) — 2026-04-29\n\n**Verdict**: Confirmed Qakbot v5.x banking trojan (high confidence).\n\nThe sample is an active malware loader that attempts to inject into\n`explorer.exe` and contact a known command-and-control server\n(`1.2.3.4`). On a compromised host, it would give the attacker the\nability to steal browser credentials and install additional payloads.\nRecommend immediate host isolation and perimeter block of the C2\ninfrastructure listed in the IOC feed.\n","markdown",[300],{"type":48,"tag":85,"props":301,"children":302},{"__ignoreMap":231},[303,316,325,350,358,367,390,417,426,435],{"type":48,"tag":237,"props":304,"children":305},{"class":239,"line":32},[306,311],{"type":48,"tag":237,"props":307,"children":308},{"style":249},[309],{"type":53,"value":310},"# ",{"type":48,"tag":237,"props":312,"children":313},{"style":270},[314],{"type":53,"value":315},"Analysis of \u003Cfilename> (\u003Csha256_short>) — 2026-04-29\n",{"type":48,"tag":237,"props":317,"children":318},{"class":239,"line":266},[319],{"type":48,"tag":237,"props":320,"children":322},{"emptyLinePlaceholder":321},true,[323],{"type":53,"value":324},"\n",{"type":48,"tag":237,"props":326,"children":328},{"class":239,"line":327},3,[329,335,341,345],{"type":48,"tag":237,"props":330,"children":332},{"style":331},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[333],{"type":53,"value":334},"**",{"type":48,"tag":237,"props":336,"children":338},{"style":337},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[339],{"type":53,"value":340},"Verdict",{"type":48,"tag":237,"props":342,"children":343},{"style":331},[344],{"type":53,"value":334},{"type":48,"tag":237,"props":346,"children":347},{"style":243},[348],{"type":53,"value":349},": Confirmed Qakbot v5.x banking trojan (high confidence).\n",{"type":48,"tag":237,"props":351,"children":353},{"class":239,"line":352},4,[354],{"type":48,"tag":237,"props":355,"children":356},{"emptyLinePlaceholder":321},[357],{"type":53,"value":324},{"type":48,"tag":237,"props":359,"children":361},{"class":239,"line":360},5,[362],{"type":48,"tag":237,"props":363,"children":364},{"style":243},[365],{"type":53,"value":366},"The sample is an active malware loader that attempts to inject into\n",{"type":48,"tag":237,"props":368,"children":370},{"class":239,"line":369},6,[371,376,381,385],{"type":48,"tag":237,"props":372,"children":373},{"style":249},[374],{"type":53,"value":375},"`",{"type":48,"tag":237,"props":377,"children":378},{"style":255},[379],{"type":53,"value":380},"explorer.exe",{"type":48,"tag":237,"props":382,"children":383},{"style":249},[384],{"type":53,"value":375},{"type":48,"tag":237,"props":386,"children":387},{"style":243},[388],{"type":53,"value":389}," and contact a known command-and-control server\n",{"type":48,"tag":237,"props":391,"children":393},{"class":239,"line":392},7,[394,399,403,408,412],{"type":48,"tag":237,"props":395,"children":396},{"style":243},[397],{"type":53,"value":398},"(",{"type":48,"tag":237,"props":400,"children":401},{"style":249},[402],{"type":53,"value":375},{"type":48,"tag":237,"props":404,"children":405},{"style":255},[406],{"type":53,"value":407},"1.2.3.4",{"type":48,"tag":237,"props":409,"children":410},{"style":249},[411],{"type":53,"value":375},{"type":48,"tag":237,"props":413,"children":414},{"style":243},[415],{"type":53,"value":416},"). On a compromised host, it would give the attacker the\n",{"type":48,"tag":237,"props":418,"children":420},{"class":239,"line":419},8,[421],{"type":48,"tag":237,"props":422,"children":423},{"style":243},[424],{"type":53,"value":425},"ability to steal browser credentials and install additional payloads.\n",{"type":48,"tag":237,"props":427,"children":429},{"class":239,"line":428},9,[430],{"type":48,"tag":237,"props":431,"children":432},{"style":243},[433],{"type":53,"value":434},"Recommend immediate host isolation and perimeter block of the C2\n",{"type":48,"tag":237,"props":436,"children":438},{"class":239,"line":437},10,[439],{"type":48,"tag":237,"props":440,"children":441},{"style":243},[442],{"type":53,"value":443},"infrastructure listed in the IOC feed.\n",{"type":48,"tag":56,"props":445,"children":446},{},[447,451],{"type":48,"tag":288,"props":448,"children":449},{},[450],{"type":53,"value":117},{"type":53,"value":452}," — structured dump, one section per stage:",{"type":48,"tag":226,"props":454,"children":456},{"className":296,"code":455,"language":298,"meta":231,"style":231},"# Technical Report — \u003Cartifact_id>\n\n## Metadata\n- Sample SHA256: ...\n- File type: ...\n- Analysis date: 2026-04-29T...\n- Pipeline run ID: ...\n\n## Stage 1 — Triage\n(quote Stage 1 envelope findings in human-readable form)\n\n## Stage 2 — OSINT recon\n...\n\n## Stage 3 — Static analysis\n...\n\n(etc., through Stage 6)\n\n## Appendix A — IOCs (see iocs.csv + iocs.stix.json for machine formats)\n| Type | Value | Source | Confidence |\n|---|---|---|---|\n\n## Appendix B — MITRE ATT&CK coverage\n| Technique | ID | Evidence |\n|---|---|---|\n",[457],{"type":48,"tag":85,"props":458,"children":459},{"__ignoreMap":231},[460,472,479,492,505,517,529,541,548,560,568,576,589,598,606,619,627,635,644,652,665,711,720,728,741,776],{"type":48,"tag":237,"props":461,"children":462},{"class":239,"line":32},[463,467],{"type":48,"tag":237,"props":464,"children":465},{"style":249},[466],{"type":53,"value":310},{"type":48,"tag":237,"props":468,"children":469},{"style":270},[470],{"type":53,"value":471},"Technical Report — \u003Cartifact_id>\n",{"type":48,"tag":237,"props":473,"children":474},{"class":239,"line":266},[475],{"type":48,"tag":237,"props":476,"children":477},{"emptyLinePlaceholder":321},[478],{"type":53,"value":324},{"type":48,"tag":237,"props":480,"children":481},{"class":239,"line":327},[482,487],{"type":48,"tag":237,"props":483,"children":484},{"style":249},[485],{"type":53,"value":486},"## ",{"type":48,"tag":237,"props":488,"children":489},{"style":270},[490],{"type":53,"value":491},"Metadata\n",{"type":48,"tag":237,"props":493,"children":494},{"class":239,"line":352},[495,500],{"type":48,"tag":237,"props":496,"children":497},{"style":249},[498],{"type":53,"value":499},"-",{"type":48,"tag":237,"props":501,"children":502},{"style":243},[503],{"type":53,"value":504}," Sample SHA256: ...\n",{"type":48,"tag":237,"props":506,"children":507},{"class":239,"line":360},[508,512],{"type":48,"tag":237,"props":509,"children":510},{"style":249},[511],{"type":53,"value":499},{"type":48,"tag":237,"props":513,"children":514},{"style":243},[515],{"type":53,"value":516}," File type: ...\n",{"type":48,"tag":237,"props":518,"children":519},{"class":239,"line":369},[520,524],{"type":48,"tag":237,"props":521,"children":522},{"style":249},[523],{"type":53,"value":499},{"type":48,"tag":237,"props":525,"children":526},{"style":243},[527],{"type":53,"value":528}," Analysis date: 2026-04-29T...\n",{"type":48,"tag":237,"props":530,"children":531},{"class":239,"line":392},[532,536],{"type":48,"tag":237,"props":533,"children":534},{"style":249},[535],{"type":53,"value":499},{"type":48,"tag":237,"props":537,"children":538},{"style":243},[539],{"type":53,"value":540}," Pipeline run ID: ...\n",{"type":48,"tag":237,"props":542,"children":543},{"class":239,"line":419},[544],{"type":48,"tag":237,"props":545,"children":546},{"emptyLinePlaceholder":321},[547],{"type":53,"value":324},{"type":48,"tag":237,"props":549,"children":550},{"class":239,"line":428},[551,555],{"type":48,"tag":237,"props":552,"children":553},{"style":249},[554],{"type":53,"value":486},{"type":48,"tag":237,"props":556,"children":557},{"style":270},[558],{"type":53,"value":559},"Stage 1 — Triage\n",{"type":48,"tag":237,"props":561,"children":562},{"class":239,"line":437},[563],{"type":48,"tag":237,"props":564,"children":565},{"style":243},[566],{"type":53,"value":567},"(quote Stage 1 envelope findings in human-readable form)\n",{"type":48,"tag":237,"props":569,"children":571},{"class":239,"line":570},11,[572],{"type":48,"tag":237,"props":573,"children":574},{"emptyLinePlaceholder":321},[575],{"type":53,"value":324},{"type":48,"tag":237,"props":577,"children":579},{"class":239,"line":578},12,[580,584],{"type":48,"tag":237,"props":581,"children":582},{"style":249},[583],{"type":53,"value":486},{"type":48,"tag":237,"props":585,"children":586},{"style":270},[587],{"type":53,"value":588},"Stage 2 — OSINT recon\n",{"type":48,"tag":237,"props":590,"children":592},{"class":239,"line":591},13,[593],{"type":48,"tag":237,"props":594,"children":595},{"style":243},[596],{"type":53,"value":597},"...\n",{"type":48,"tag":237,"props":599,"children":601},{"class":239,"line":600},14,[602],{"type":48,"tag":237,"props":603,"children":604},{"emptyLinePlaceholder":321},[605],{"type":53,"value":324},{"type":48,"tag":237,"props":607,"children":609},{"class":239,"line":608},15,[610,614],{"type":48,"tag":237,"props":611,"children":612},{"style":249},[613],{"type":53,"value":486},{"type":48,"tag":237,"props":615,"children":616},{"style":270},[617],{"type":53,"value":618},"Stage 3 — Static analysis\n",{"type":48,"tag":237,"props":620,"children":622},{"class":239,"line":621},16,[623],{"type":48,"tag":237,"props":624,"children":625},{"style":243},[626],{"type":53,"value":597},{"type":48,"tag":237,"props":628,"children":630},{"class":239,"line":629},17,[631],{"type":48,"tag":237,"props":632,"children":633},{"emptyLinePlaceholder":321},[634],{"type":53,"value":324},{"type":48,"tag":237,"props":636,"children":638},{"class":239,"line":637},18,[639],{"type":48,"tag":237,"props":640,"children":641},{"style":243},[642],{"type":53,"value":643},"(etc., through Stage 6)\n",{"type":48,"tag":237,"props":645,"children":647},{"class":239,"line":646},19,[648],{"type":48,"tag":237,"props":649,"children":650},{"emptyLinePlaceholder":321},[651],{"type":53,"value":324},{"type":48,"tag":237,"props":653,"children":655},{"class":239,"line":654},20,[656,660],{"type":48,"tag":237,"props":657,"children":658},{"style":249},[659],{"type":53,"value":486},{"type":48,"tag":237,"props":661,"children":662},{"style":270},[663],{"type":53,"value":664},"Appendix A — IOCs (see iocs.csv + iocs.stix.json for machine formats)\n",{"type":48,"tag":237,"props":666,"children":668},{"class":239,"line":667},21,[669,674,679,683,688,692,697,701,706],{"type":48,"tag":237,"props":670,"children":671},{"style":249},[672],{"type":53,"value":673},"|",{"type":48,"tag":237,"props":675,"children":676},{"style":243},[677],{"type":53,"value":678}," Type ",{"type":48,"tag":237,"props":680,"children":681},{"style":249},[682],{"type":53,"value":673},{"type":48,"tag":237,"props":684,"children":685},{"style":243},[686],{"type":53,"value":687}," Value ",{"type":48,"tag":237,"props":689,"children":690},{"style":249},[691],{"type":53,"value":673},{"type":48,"tag":237,"props":693,"children":694},{"style":243},[695],{"type":53,"value":696}," Source ",{"type":48,"tag":237,"props":698,"children":699},{"style":249},[700],{"type":53,"value":673},{"type":48,"tag":237,"props":702,"children":703},{"style":243},[704],{"type":53,"value":705}," Confidence ",{"type":48,"tag":237,"props":707,"children":708},{"style":249},[709],{"type":53,"value":710},"|\n",{"type":48,"tag":237,"props":712,"children":714},{"class":239,"line":713},22,[715],{"type":48,"tag":237,"props":716,"children":717},{"style":249},[718],{"type":53,"value":719},"|---|---|---|---|\n",{"type":48,"tag":237,"props":721,"children":723},{"class":239,"line":722},23,[724],{"type":48,"tag":237,"props":725,"children":726},{"emptyLinePlaceholder":321},[727],{"type":53,"value":324},{"type":48,"tag":237,"props":729,"children":731},{"class":239,"line":730},24,[732,736],{"type":48,"tag":237,"props":733,"children":734},{"style":249},[735],{"type":53,"value":486},{"type":48,"tag":237,"props":737,"children":738},{"style":270},[739],{"type":53,"value":740},"Appendix B — MITRE ATT&CK coverage\n",{"type":48,"tag":237,"props":742,"children":744},{"class":239,"line":743},25,[745,749,754,758,763,767,772],{"type":48,"tag":237,"props":746,"children":747},{"style":249},[748],{"type":53,"value":673},{"type":48,"tag":237,"props":750,"children":751},{"style":243},[752],{"type":53,"value":753}," Technique ",{"type":48,"tag":237,"props":755,"children":756},{"style":249},[757],{"type":53,"value":673},{"type":48,"tag":237,"props":759,"children":760},{"style":243},[761],{"type":53,"value":762}," ID ",{"type":48,"tag":237,"props":764,"children":765},{"style":249},[766],{"type":53,"value":673},{"type":48,"tag":237,"props":768,"children":769},{"style":243},[770],{"type":53,"value":771}," Evidence ",{"type":48,"tag":237,"props":773,"children":774},{"style":249},[775],{"type":53,"value":710},{"type":48,"tag":237,"props":777,"children":779},{"class":239,"line":778},26,[780],{"type":48,"tag":237,"props":781,"children":782},{"style":249},[783],{"type":53,"value":784},"|---|---|---|\n",{"type":48,"tag":56,"props":786,"children":787},{},[788,792],{"type":48,"tag":288,"props":789,"children":790},{},[791],{"type":53,"value":128},{"type":53,"value":793}," — copy Stage 6's STIX bundle verbatim.",{"type":48,"tag":56,"props":795,"children":796},{},[797,801],{"type":48,"tag":288,"props":798,"children":799},{},[800],{"type":53,"value":139},{"type":53,"value":802}," — copy Stage 6's CSV verbatim.",{"type":48,"tag":56,"props":804,"children":805},{},[806,810,812,818],{"type":48,"tag":288,"props":807,"children":808},{},[809],{"type":53,"value":150},{"type":53,"value":811}," — Stage 4's event timeline if it exists, else empty ",{"type":48,"tag":85,"props":813,"children":815},{"className":814},[],[816],{"type":53,"value":817},"[]",{"type":53,"value":819},".",{"type":48,"tag":56,"props":821,"children":822},{},[823,827],{"type":48,"tag":288,"props":824,"children":825},{},[826],{"type":53,"value":161},{"type":53,"value":828}," — use the template:",{"type":48,"tag":226,"props":830,"children":834},{"className":831,"code":833,"language":53},[832],"language-text","index=* (hash=\u003Csha256> OR hash=\u003Cmd5>)\nindex=* dest_ip IN (1.2.3.4)\nindex=sysmon EventCode=10 TargetImage=\"*explorer.exe\" GrantedAccess=\"0x1FFFFF\"\nindex=sysmon EventCode=13 TargetObject=\"*\\\\CurrentVersion\\\\Run\\\\*\" Image=\"\u003Cprocess>\"\n",[835],{"type":48,"tag":85,"props":836,"children":837},{"__ignoreMap":231},[838],{"type":53,"value":833},{"type":48,"tag":56,"props":840,"children":841},{},[842,846],{"type":48,"tag":288,"props":843,"children":844},{},[845],{"type":53,"value":170},{"type":53,"value":92},{"type":48,"tag":226,"props":848,"children":851},{"className":849,"code":850,"language":53},[832],"hash:(\"\u003Csha256>\" OR \"\u003Cmd5>\") OR destination.ip:\"1.2.3.4\"\nprocess.name:explorer.exe AND event.code:10 AND winlog.event_data.GrantedAccess:\"0x1FFFFF\"\n",[852],{"type":48,"tag":85,"props":853,"children":854},{"__ignoreMap":231},[855],{"type":53,"value":850},{"type":48,"tag":56,"props":857,"children":858},{},[859,863],{"type":48,"tag":288,"props":860,"children":861},{},[862],{"type":53,"value":179},{"type":53,"value":864}," (KQL):",{"type":48,"tag":226,"props":866,"children":870},{"className":867,"code":868,"language":869,"meta":231,"style":231},"language-kusto shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","DeviceFileEvents | where SHA256 == \"...\"\nDeviceNetworkEvents | where RemoteIP == \"1.2.3.4\"\nDeviceProcessEvents | where InitiatingProcessFileName == \"explorer.exe\"\n","kusto",[871],{"type":48,"tag":85,"props":872,"children":873},{"__ignoreMap":231},[874,882,890],{"type":48,"tag":237,"props":875,"children":876},{"class":239,"line":32},[877],{"type":48,"tag":237,"props":878,"children":879},{},[880],{"type":53,"value":881},"DeviceFileEvents | where SHA256 == \"...\"\n",{"type":48,"tag":237,"props":883,"children":884},{"class":239,"line":266},[885],{"type":48,"tag":237,"props":886,"children":887},{},[888],{"type":53,"value":889},"DeviceNetworkEvents | where RemoteIP == \"1.2.3.4\"\n",{"type":48,"tag":237,"props":891,"children":892},{"class":239,"line":327},[893],{"type":48,"tag":237,"props":894,"children":895},{},[896],{"type":53,"value":897},"DeviceProcessEvents | where InitiatingProcessFileName == \"explorer.exe\"\n",{"type":48,"tag":56,"props":899,"children":900},{},[901,905],{"type":48,"tag":288,"props":902,"children":903},{},[904],{"type":53,"value":188},{"type":53,"value":906}," — merge all DDB rows for this artifact_id:",{"type":48,"tag":226,"props":908,"children":910},{"className":228,"code":909,"language":230,"meta":231,"style":231},"aws dynamodb query --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --key-condition-expression \"artifact_id = :a\" \\\n  --expression-attribute-values '{\":a\":{\"S\":\"'\"$ARTIFACT_ID\"'\"}}' \\\n  --query 'Items' --output json > $WORKDIR\u002Fpipeline_envelope.json\n",[911],{"type":48,"tag":85,"props":912,"children":913},{"__ignoreMap":231},[914,947,974,999,1046],{"type":48,"tag":237,"props":915,"children":916},{"class":239,"line":32},[917,922,927,932,937,942],{"type":48,"tag":237,"props":918,"children":919},{"style":270},[920],{"type":53,"value":921},"aws",{"type":48,"tag":237,"props":923,"children":924},{"style":255},[925],{"type":53,"value":926}," dynamodb",{"type":48,"tag":237,"props":928,"children":929},{"style":255},[930],{"type":53,"value":931}," query",{"type":48,"tag":237,"props":933,"children":934},{"style":255},[935],{"type":53,"value":936}," --region",{"type":48,"tag":237,"props":938,"children":939},{"style":255},[940],{"type":53,"value":941}," us-east-1",{"type":48,"tag":237,"props":943,"children":944},{"style":243},[945],{"type":53,"value":946}," \\\n",{"type":48,"tag":237,"props":948,"children":949},{"class":239,"line":266},[950,955,960,965,970],{"type":48,"tag":237,"props":951,"children":952},{"style":255},[953],{"type":53,"value":954},"  --table-name",{"type":48,"tag":237,"props":956,"children":957},{"style":249},[958],{"type":53,"value":959}," \"",{"type":48,"tag":237,"props":961,"children":962},{"style":243},[963],{"type":53,"value":964},"$CYBER_RESULTS_TABLE",{"type":48,"tag":237,"props":966,"children":967},{"style":249},[968],{"type":53,"value":969},"\"",{"type":48,"tag":237,"props":971,"children":972},{"style":243},[973],{"type":53,"value":946},{"type":48,"tag":237,"props":975,"children":976},{"class":239,"line":327},[977,982,986,991,995],{"type":48,"tag":237,"props":978,"children":979},{"style":255},[980],{"type":53,"value":981},"  --key-condition-expression",{"type":48,"tag":237,"props":983,"children":984},{"style":249},[985],{"type":53,"value":959},{"type":48,"tag":237,"props":987,"children":988},{"style":255},[989],{"type":53,"value":990},"artifact_id = :a",{"type":48,"tag":237,"props":992,"children":993},{"style":249},[994],{"type":53,"value":969},{"type":48,"tag":237,"props":996,"children":997},{"style":243},[998],{"type":53,"value":946},{"type":48,"tag":237,"props":1000,"children":1001},{"class":239,"line":352},[1002,1007,1012,1017,1022,1027,1032,1037,1042],{"type":48,"tag":237,"props":1003,"children":1004},{"style":255},[1005],{"type":53,"value":1006},"  --expression-attribute-values",{"type":48,"tag":237,"props":1008,"children":1009},{"style":249},[1010],{"type":53,"value":1011}," '",{"type":48,"tag":237,"props":1013,"children":1014},{"style":255},[1015],{"type":53,"value":1016},"{\":a\":{\"S\":\"",{"type":48,"tag":237,"props":1018,"children":1019},{"style":249},[1020],{"type":53,"value":1021},"'\"",{"type":48,"tag":237,"props":1023,"children":1024},{"style":243},[1025],{"type":53,"value":1026},"$ARTIFACT_ID",{"type":48,"tag":237,"props":1028,"children":1029},{"style":249},[1030],{"type":53,"value":1031},"\"'",{"type":48,"tag":237,"props":1033,"children":1034},{"style":255},[1035],{"type":53,"value":1036},"\"}}",{"type":48,"tag":237,"props":1038,"children":1039},{"style":249},[1040],{"type":53,"value":1041},"'",{"type":48,"tag":237,"props":1043,"children":1044},{"style":243},[1045],{"type":53,"value":946},{"type":48,"tag":237,"props":1047,"children":1048},{"class":239,"line":360},[1049,1054,1058,1063,1067,1072,1077,1082,1087],{"type":48,"tag":237,"props":1050,"children":1051},{"style":255},[1052],{"type":53,"value":1053},"  --query",{"type":48,"tag":237,"props":1055,"children":1056},{"style":249},[1057],{"type":53,"value":1011},{"type":48,"tag":237,"props":1059,"children":1060},{"style":255},[1061],{"type":53,"value":1062},"Items",{"type":48,"tag":237,"props":1064,"children":1065},{"style":249},[1066],{"type":53,"value":1041},{"type":48,"tag":237,"props":1068,"children":1069},{"style":255},[1070],{"type":53,"value":1071}," --output",{"type":48,"tag":237,"props":1073,"children":1074},{"style":255},[1075],{"type":53,"value":1076}," json",{"type":48,"tag":237,"props":1078,"children":1079},{"style":249},[1080],{"type":53,"value":1081}," >",{"type":48,"tag":237,"props":1083,"children":1084},{"style":243},[1085],{"type":53,"value":1086}," $WORKDIR",{"type":48,"tag":237,"props":1088,"children":1089},{"style":255},[1090],{"type":53,"value":1091},"\u002Fpipeline_envelope.json\n",{"type":48,"tag":219,"props":1093,"children":1095},{"id":1094},"_2-upload-everything-to-s3",[1096],{"type":53,"value":1097},"2. Upload everything to S3",{"type":48,"tag":226,"props":1099,"children":1101},{"className":228,"code":1100,"language":230,"meta":231,"style":231},"S3_PREFIX=\"s3:\u002F\u002F$CYBER_ARTIFACTS_BUCKET\u002Freports\u002F$ARTIFACT_ID\"\naws s3 sync $WORKDIR\u002F \"$S3_PREFIX\u002F\" --region us-east-1\n",[1102],{"type":48,"tag":85,"props":1103,"children":1104},{"__ignoreMap":231},[1105,1145],{"type":48,"tag":237,"props":1106,"children":1107},{"class":239,"line":32},[1108,1113,1117,1121,1126,1131,1136,1140],{"type":48,"tag":237,"props":1109,"children":1110},{"style":243},[1111],{"type":53,"value":1112},"S3_PREFIX",{"type":48,"tag":237,"props":1114,"children":1115},{"style":249},[1116],{"type":53,"value":252},{"type":48,"tag":237,"props":1118,"children":1119},{"style":249},[1120],{"type":53,"value":969},{"type":48,"tag":237,"props":1122,"children":1123},{"style":255},[1124],{"type":53,"value":1125},"s3:\u002F\u002F",{"type":48,"tag":237,"props":1127,"children":1128},{"style":243},[1129],{"type":53,"value":1130},"$CYBER_ARTIFACTS_BUCKET",{"type":48,"tag":237,"props":1132,"children":1133},{"style":255},[1134],{"type":53,"value":1135},"\u002Freports\u002F",{"type":48,"tag":237,"props":1137,"children":1138},{"style":243},[1139],{"type":53,"value":1026},{"type":48,"tag":237,"props":1141,"children":1142},{"style":249},[1143],{"type":53,"value":1144},"\"\n",{"type":48,"tag":237,"props":1146,"children":1147},{"class":239,"line":266},[1148,1152,1157,1162,1166,1171,1175,1180,1184,1188,1192],{"type":48,"tag":237,"props":1149,"children":1150},{"style":270},[1151],{"type":53,"value":921},{"type":48,"tag":237,"props":1153,"children":1154},{"style":255},[1155],{"type":53,"value":1156}," s3",{"type":48,"tag":237,"props":1158,"children":1159},{"style":255},[1160],{"type":53,"value":1161}," sync",{"type":48,"tag":237,"props":1163,"children":1164},{"style":243},[1165],{"type":53,"value":1086},{"type":48,"tag":237,"props":1167,"children":1168},{"style":255},[1169],{"type":53,"value":1170},"\u002F",{"type":48,"tag":237,"props":1172,"children":1173},{"style":249},[1174],{"type":53,"value":959},{"type":48,"tag":237,"props":1176,"children":1177},{"style":243},[1178],{"type":53,"value":1179},"$S3_PREFIX",{"type":48,"tag":237,"props":1181,"children":1182},{"style":255},[1183],{"type":53,"value":1170},{"type":48,"tag":237,"props":1185,"children":1186},{"style":249},[1187],{"type":53,"value":969},{"type":48,"tag":237,"props":1189,"children":1190},{"style":255},[1191],{"type":53,"value":936},{"type":48,"tag":237,"props":1193,"children":1194},{"style":255},[1195],{"type":53,"value":1196}," us-east-1\n",{"type":48,"tag":219,"props":1198,"children":1200},{"id":1199},"_3-generate-presigned-urls-7-day-expiry",[1201],{"type":53,"value":1202},"3. Generate presigned URLs (7-day expiry)",{"type":48,"tag":226,"props":1204,"children":1206},{"className":228,"code":1205,"language":230,"meta":231,"style":231},"for f in $WORKDIR\u002F*; do\n  NAME=$(basename \"$f\")\n  URL=$(aws s3 presign \"$S3_PREFIX\u002F$NAME\" --expires-in 604800 --region us-east-1)\n  echo \"$NAME → $URL\"\ndone\n",[1207],{"type":48,"tag":85,"props":1208,"children":1209},{"__ignoreMap":231},[1210,1248,1284,1353,1384],{"type":48,"tag":237,"props":1211,"children":1212},{"class":239,"line":32},[1213,1219,1224,1229,1233,1238,1243],{"type":48,"tag":237,"props":1214,"children":1216},{"style":1215},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1217],{"type":53,"value":1218},"for",{"type":48,"tag":237,"props":1220,"children":1221},{"style":243},[1222],{"type":53,"value":1223}," f ",{"type":48,"tag":237,"props":1225,"children":1226},{"style":1215},[1227],{"type":53,"value":1228},"in",{"type":48,"tag":237,"props":1230,"children":1231},{"style":243},[1232],{"type":53,"value":1086},{"type":48,"tag":237,"props":1234,"children":1235},{"style":255},[1236],{"type":53,"value":1237},"\u002F*",{"type":48,"tag":237,"props":1239,"children":1240},{"style":249},[1241],{"type":53,"value":1242},";",{"type":48,"tag":237,"props":1244,"children":1245},{"style":1215},[1246],{"type":53,"value":1247}," do\n",{"type":48,"tag":237,"props":1249,"children":1250},{"class":239,"line":266},[1251,1256,1261,1266,1270,1275,1279],{"type":48,"tag":237,"props":1252,"children":1253},{"style":243},[1254],{"type":53,"value":1255},"  NAME",{"type":48,"tag":237,"props":1257,"children":1258},{"style":249},[1259],{"type":53,"value":1260},"=$(",{"type":48,"tag":237,"props":1262,"children":1263},{"style":270},[1264],{"type":53,"value":1265},"basename",{"type":48,"tag":237,"props":1267,"children":1268},{"style":249},[1269],{"type":53,"value":959},{"type":48,"tag":237,"props":1271,"children":1272},{"style":243},[1273],{"type":53,"value":1274},"$f",{"type":48,"tag":237,"props":1276,"children":1277},{"style":249},[1278],{"type":53,"value":969},{"type":48,"tag":237,"props":1280,"children":1281},{"style":249},[1282],{"type":53,"value":1283},")\n",{"type":48,"tag":237,"props":1285,"children":1286},{"class":239,"line":327},[1287,1292,1296,1300,1304,1309,1313,1317,1321,1326,1330,1335,1341,1345,1349],{"type":48,"tag":237,"props":1288,"children":1289},{"style":243},[1290],{"type":53,"value":1291},"  URL",{"type":48,"tag":237,"props":1293,"children":1294},{"style":249},[1295],{"type":53,"value":1260},{"type":48,"tag":237,"props":1297,"children":1298},{"style":270},[1299],{"type":53,"value":921},{"type":48,"tag":237,"props":1301,"children":1302},{"style":255},[1303],{"type":53,"value":1156},{"type":48,"tag":237,"props":1305,"children":1306},{"style":255},[1307],{"type":53,"value":1308}," presign",{"type":48,"tag":237,"props":1310,"children":1311},{"style":249},[1312],{"type":53,"value":959},{"type":48,"tag":237,"props":1314,"children":1315},{"style":243},[1316],{"type":53,"value":1179},{"type":48,"tag":237,"props":1318,"children":1319},{"style":255},[1320],{"type":53,"value":1170},{"type":48,"tag":237,"props":1322,"children":1323},{"style":243},[1324],{"type":53,"value":1325},"$NAME",{"type":48,"tag":237,"props":1327,"children":1328},{"style":249},[1329],{"type":53,"value":969},{"type":48,"tag":237,"props":1331,"children":1332},{"style":255},[1333],{"type":53,"value":1334}," --expires-in",{"type":48,"tag":237,"props":1336,"children":1338},{"style":1337},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[1339],{"type":53,"value":1340}," 604800",{"type":48,"tag":237,"props":1342,"children":1343},{"style":255},[1344],{"type":53,"value":936},{"type":48,"tag":237,"props":1346,"children":1347},{"style":255},[1348],{"type":53,"value":941},{"type":48,"tag":237,"props":1350,"children":1351},{"style":249},[1352],{"type":53,"value":1283},{"type":48,"tag":237,"props":1354,"children":1355},{"class":239,"line":352},[1356,1362,1366,1370,1375,1380],{"type":48,"tag":237,"props":1357,"children":1359},{"style":1358},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1360],{"type":53,"value":1361},"  echo",{"type":48,"tag":237,"props":1363,"children":1364},{"style":249},[1365],{"type":53,"value":959},{"type":48,"tag":237,"props":1367,"children":1368},{"style":243},[1369],{"type":53,"value":1325},{"type":48,"tag":237,"props":1371,"children":1372},{"style":255},[1373],{"type":53,"value":1374}," → ",{"type":48,"tag":237,"props":1376,"children":1377},{"style":243},[1378],{"type":53,"value":1379},"$URL",{"type":48,"tag":237,"props":1381,"children":1382},{"style":249},[1383],{"type":53,"value":1144},{"type":48,"tag":237,"props":1385,"children":1386},{"class":239,"line":360},[1387],{"type":48,"tag":237,"props":1388,"children":1389},{"style":1215},[1390],{"type":53,"value":1391},"done\n",{"type":48,"tag":219,"props":1393,"children":1395},{"id":1394},"_4-write-final-ddb-envelope",[1396],{"type":53,"value":1397},"4. Write final DDB envelope",{"type":48,"tag":226,"props":1399,"children":1401},{"className":228,"code":1400,"language":230,"meta":231,"style":231},"aws dynamodb put-item --region us-east-1 \\\n  --table-name \"$CYBER_RESULTS_TABLE\" \\\n  --item \"$(jq -n --arg a \"$ARTIFACT_ID\" --arg sk \"report#$(date -u +%s)\" --arg s3 \"$S3_PREFIX\" \\\n    '{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"report\"}, status:{S:\"reported\"}, s3_prefix:{S:$s3}}')\"\n",[1402],{"type":48,"tag":85,"props":1403,"children":1404},{"__ignoreMap":231},[1405,1433,1456,1546],{"type":48,"tag":237,"props":1406,"children":1407},{"class":239,"line":32},[1408,1412,1416,1421,1425,1429],{"type":48,"tag":237,"props":1409,"children":1410},{"style":270},[1411],{"type":53,"value":921},{"type":48,"tag":237,"props":1413,"children":1414},{"style":255},[1415],{"type":53,"value":926},{"type":48,"tag":237,"props":1417,"children":1418},{"style":255},[1419],{"type":53,"value":1420}," put-item",{"type":48,"tag":237,"props":1422,"children":1423},{"style":255},[1424],{"type":53,"value":936},{"type":48,"tag":237,"props":1426,"children":1427},{"style":255},[1428],{"type":53,"value":941},{"type":48,"tag":237,"props":1430,"children":1431},{"style":243},[1432],{"type":53,"value":946},{"type":48,"tag":237,"props":1434,"children":1435},{"class":239,"line":266},[1436,1440,1444,1448,1452],{"type":48,"tag":237,"props":1437,"children":1438},{"style":255},[1439],{"type":53,"value":954},{"type":48,"tag":237,"props":1441,"children":1442},{"style":249},[1443],{"type":53,"value":959},{"type":48,"tag":237,"props":1445,"children":1446},{"style":243},[1447],{"type":53,"value":964},{"type":48,"tag":237,"props":1449,"children":1450},{"style":249},[1451],{"type":53,"value":969},{"type":48,"tag":237,"props":1453,"children":1454},{"style":243},[1455],{"type":53,"value":946},{"type":48,"tag":237,"props":1457,"children":1458},{"class":239,"line":327},[1459,1464,1469,1474,1479,1483,1487,1491,1496,1500,1505,1510,1515,1520,1525,1530,1534,1538,1542],{"type":48,"tag":237,"props":1460,"children":1461},{"style":255},[1462],{"type":53,"value":1463},"  --item",{"type":48,"tag":237,"props":1465,"children":1466},{"style":249},[1467],{"type":53,"value":1468}," \"$(",{"type":48,"tag":237,"props":1470,"children":1471},{"style":270},[1472],{"type":53,"value":1473},"jq",{"type":48,"tag":237,"props":1475,"children":1476},{"style":255},[1477],{"type":53,"value":1478}," -n --arg a ",{"type":48,"tag":237,"props":1480,"children":1481},{"style":249},[1482],{"type":53,"value":969},{"type":48,"tag":237,"props":1484,"children":1485},{"style":243},[1486],{"type":53,"value":1026},{"type":48,"tag":237,"props":1488,"children":1489},{"style":249},[1490],{"type":53,"value":969},{"type":48,"tag":237,"props":1492,"children":1493},{"style":255},[1494],{"type":53,"value":1495}," --arg sk ",{"type":48,"tag":237,"props":1497,"children":1498},{"style":249},[1499],{"type":53,"value":969},{"type":48,"tag":237,"props":1501,"children":1502},{"style":255},[1503],{"type":53,"value":1504},"report#",{"type":48,"tag":237,"props":1506,"children":1507},{"style":249},[1508],{"type":53,"value":1509},"$(",{"type":48,"tag":237,"props":1511,"children":1512},{"style":270},[1513],{"type":53,"value":1514},"date",{"type":48,"tag":237,"props":1516,"children":1517},{"style":255},[1518],{"type":53,"value":1519}," -u +%s",{"type":48,"tag":237,"props":1521,"children":1522},{"style":249},[1523],{"type":53,"value":1524},")\"",{"type":48,"tag":237,"props":1526,"children":1527},{"style":255},[1528],{"type":53,"value":1529}," --arg s3 ",{"type":48,"tag":237,"props":1531,"children":1532},{"style":249},[1533],{"type":53,"value":969},{"type":48,"tag":237,"props":1535,"children":1536},{"style":243},[1537],{"type":53,"value":1179},{"type":48,"tag":237,"props":1539,"children":1540},{"style":249},[1541],{"type":53,"value":969},{"type":48,"tag":237,"props":1543,"children":1544},{"style":243},[1545],{"type":53,"value":946},{"type":48,"tag":237,"props":1547,"children":1548},{"class":239,"line":352},[1549,1554,1559],{"type":48,"tag":237,"props":1550,"children":1551},{"style":249},[1552],{"type":53,"value":1553},"    '",{"type":48,"tag":237,"props":1555,"children":1556},{"style":255},[1557],{"type":53,"value":1558},"{artifact_id:{S:$a}, stage_timestamp:{S:$sk}, stage:{S:\"report\"}, status:{S:\"reported\"}, s3_prefix:{S:$s3}}",{"type":48,"tag":237,"props":1560,"children":1561},{"style":249},[1562],{"type":53,"value":1563},"')\"\n",{"type":48,"tag":219,"props":1565,"children":1567},{"id":1566},"_5-publish-final-comment",[1568],{"type":53,"value":1569},"5. Publish final comment",{"type":48,"tag":226,"props":1571,"children":1573},{"className":296,"code":1572,"language":298,"meta":231,"style":231},"## Stage 7 — Report 📋\n\n**Analysis complete.** Total pipeline wall time: 23m 14s | Model: claude-opus-4-6 | Tool calls: 42\n\n### Executive summary\n> \u003Ccopy executive_summary.md content inline — 3-5 sentences>\n\n### Verdict\n🔴 **MALICIOUS** — high confidence — Qakbot v5.x\n\n### Artifacts\n- [Executive summary](\u003Cpresigned>) — 1 KB, 3-5 sentences\n- [Technical report](\u003Cpresigned>) — full structured report\n- [IOCs STIX 2.1](\u003Cpresigned>) — machine-readable feed\n- [IOCs CSV](\u003Cpresigned>) — spreadsheet-friendly\n- [Timeline JSON](\u003Cpresigned>) — event sequence from CAPE\n- [Splunk hunt queries](\u003Cpresigned>)\n- [Elastic hunt queries](\u003Cpresigned>)\n- [Sentinel KQL queries](\u003Cpresigned>)\n- [Full pipeline envelope](\u003Cpresigned>) — all 7 stage outputs merged\n\nAll links expire in 7 days.\n\n### Stage-by-stage comments\n- [Stage 1 — Triage](#)\n- [Stage 2 — OSINT recon](#)\n- [Stage 3 — Static analysis](#)\n- [Stage 4 — Dynamic analysis](#)\n- [Stage 5 — Correlation](#)\n- [Stage 6 — Verdict](#)\n\nPipeline complete. Close the issue when findings have been acted on.\n",[1574],{"type":48,"tag":85,"props":1575,"children":1576},{"__ignoreMap":231},[1577,1589,1596,1617,1624,1637,1651,1658,1670,1696,1703,1715,1753,1786,1819,1852,1885,1914,1942,1970,2003,2010,2018,2025,2037,2067,2095,2124,2153,2182,2211,2219],{"type":48,"tag":237,"props":1578,"children":1579},{"class":239,"line":32},[1580,1584],{"type":48,"tag":237,"props":1581,"children":1582},{"style":249},[1583],{"type":53,"value":486},{"type":48,"tag":237,"props":1585,"children":1586},{"style":270},[1587],{"type":53,"value":1588},"Stage 7 — Report 📋\n",{"type":48,"tag":237,"props":1590,"children":1591},{"class":239,"line":266},[1592],{"type":48,"tag":237,"props":1593,"children":1594},{"emptyLinePlaceholder":321},[1595],{"type":53,"value":324},{"type":48,"tag":237,"props":1597,"children":1598},{"class":239,"line":327},[1599,1603,1608,1612],{"type":48,"tag":237,"props":1600,"children":1601},{"style":331},[1602],{"type":53,"value":334},{"type":48,"tag":237,"props":1604,"children":1605},{"style":337},[1606],{"type":53,"value":1607},"Analysis complete.",{"type":48,"tag":237,"props":1609,"children":1610},{"style":331},[1611],{"type":53,"value":334},{"type":48,"tag":237,"props":1613,"children":1614},{"style":243},[1615],{"type":53,"value":1616}," Total pipeline wall time: 23m 14s | Model: claude-opus-4-6 | Tool calls: 42\n",{"type":48,"tag":237,"props":1618,"children":1619},{"class":239,"line":352},[1620],{"type":48,"tag":237,"props":1621,"children":1622},{"emptyLinePlaceholder":321},[1623],{"type":53,"value":324},{"type":48,"tag":237,"props":1625,"children":1626},{"class":239,"line":360},[1627,1632],{"type":48,"tag":237,"props":1628,"children":1629},{"style":249},[1630],{"type":53,"value":1631},"### ",{"type":48,"tag":237,"props":1633,"children":1634},{"style":270},[1635],{"type":53,"value":1636},"Executive summary\n",{"type":48,"tag":237,"props":1638,"children":1639},{"class":239,"line":369},[1640,1646],{"type":48,"tag":237,"props":1641,"children":1643},{"style":1642},"--shiki-light:#FF5370;--shiki-light-font-style:italic;--shiki-default:#FF9CAC;--shiki-default-font-style:italic;--shiki-dark:#FF9CAC;--shiki-dark-font-style:italic",[1644],{"type":53,"value":1645},">",{"type":48,"tag":237,"props":1647,"children":1648},{"style":1215},[1649],{"type":53,"value":1650}," \u003Ccopy executive_summary.md content inline — 3-5 sentences>\n",{"type":48,"tag":237,"props":1652,"children":1653},{"class":239,"line":392},[1654],{"type":48,"tag":237,"props":1655,"children":1656},{"emptyLinePlaceholder":321},[1657],{"type":53,"value":324},{"type":48,"tag":237,"props":1659,"children":1660},{"class":239,"line":419},[1661,1665],{"type":48,"tag":237,"props":1662,"children":1663},{"style":249},[1664],{"type":53,"value":1631},{"type":48,"tag":237,"props":1666,"children":1667},{"style":270},[1668],{"type":53,"value":1669},"Verdict\n",{"type":48,"tag":237,"props":1671,"children":1672},{"class":239,"line":428},[1673,1678,1682,1687,1691],{"type":48,"tag":237,"props":1674,"children":1675},{"style":243},[1676],{"type":53,"value":1677},"🔴 ",{"type":48,"tag":237,"props":1679,"children":1680},{"style":331},[1681],{"type":53,"value":334},{"type":48,"tag":237,"props":1683,"children":1684},{"style":337},[1685],{"type":53,"value":1686},"MALICIOUS",{"type":48,"tag":237,"props":1688,"children":1689},{"style":331},[1690],{"type":53,"value":334},{"type":48,"tag":237,"props":1692,"children":1693},{"style":243},[1694],{"type":53,"value":1695}," — high confidence — Qakbot v5.x\n",{"type":48,"tag":237,"props":1697,"children":1698},{"class":239,"line":437},[1699],{"type":48,"tag":237,"props":1700,"children":1701},{"emptyLinePlaceholder":321},[1702],{"type":53,"value":324},{"type":48,"tag":237,"props":1704,"children":1705},{"class":239,"line":570},[1706,1710],{"type":48,"tag":237,"props":1707,"children":1708},{"style":249},[1709],{"type":53,"value":1631},{"type":48,"tag":237,"props":1711,"children":1712},{"style":270},[1713],{"type":53,"value":1714},"Artifacts\n",{"type":48,"tag":237,"props":1716,"children":1717},{"class":239,"line":578},[1718,1722,1727,1732,1737,1743,1748],{"type":48,"tag":237,"props":1719,"children":1720},{"style":249},[1721],{"type":53,"value":499},{"type":48,"tag":237,"props":1723,"children":1724},{"style":249},[1725],{"type":53,"value":1726}," [",{"type":48,"tag":237,"props":1728,"children":1729},{"style":255},[1730],{"type":53,"value":1731},"Executive summary",{"type":48,"tag":237,"props":1733,"children":1734},{"style":249},[1735],{"type":53,"value":1736},"](\u003C",{"type":48,"tag":237,"props":1738,"children":1740},{"style":1739},"--shiki-light:#E53935;--shiki-light-text-decoration:underline;--shiki-default:#F07178;--shiki-default-text-decoration:underline;--shiki-dark:#F07178;--shiki-dark-text-decoration:underline",[1741],{"type":53,"value":1742},"presigned",{"type":48,"tag":237,"props":1744,"children":1745},{"style":249},[1746],{"type":53,"value":1747},">)",{"type":48,"tag":237,"props":1749,"children":1750},{"style":243},[1751],{"type":53,"value":1752}," — 1 KB, 3-5 sentences\n",{"type":48,"tag":237,"props":1754,"children":1755},{"class":239,"line":591},[1756,1760,1764,1769,1773,1777,1781],{"type":48,"tag":237,"props":1757,"children":1758},{"style":249},[1759],{"type":53,"value":499},{"type":48,"tag":237,"props":1761,"children":1762},{"style":249},[1763],{"type":53,"value":1726},{"type":48,"tag":237,"props":1765,"children":1766},{"style":255},[1767],{"type":53,"value":1768},"Technical report",{"type":48,"tag":237,"props":1770,"children":1771},{"style":249},[1772],{"type":53,"value":1736},{"type":48,"tag":237,"props":1774,"children":1775},{"style":1739},[1776],{"type":53,"value":1742},{"type":48,"tag":237,"props":1778,"children":1779},{"style":249},[1780],{"type":53,"value":1747},{"type":48,"tag":237,"props":1782,"children":1783},{"style":243},[1784],{"type":53,"value":1785}," — full structured report\n",{"type":48,"tag":237,"props":1787,"children":1788},{"class":239,"line":600},[1789,1793,1797,1802,1806,1810,1814],{"type":48,"tag":237,"props":1790,"children":1791},{"style":249},[1792],{"type":53,"value":499},{"type":48,"tag":237,"props":1794,"children":1795},{"style":249},[1796],{"type":53,"value":1726},{"type":48,"tag":237,"props":1798,"children":1799},{"style":255},[1800],{"type":53,"value":1801},"IOCs STIX 2.1",{"type":48,"tag":237,"props":1803,"children":1804},{"style":249},[1805],{"type":53,"value":1736},{"type":48,"tag":237,"props":1807,"children":1808},{"style":1739},[1809],{"type":53,"value":1742},{"type":48,"tag":237,"props":1811,"children":1812},{"style":249},[1813],{"type":53,"value":1747},{"type":48,"tag":237,"props":1815,"children":1816},{"style":243},[1817],{"type":53,"value":1818}," — machine-readable feed\n",{"type":48,"tag":237,"props":1820,"children":1821},{"class":239,"line":608},[1822,1826,1830,1835,1839,1843,1847],{"type":48,"tag":237,"props":1823,"children":1824},{"style":249},[1825],{"type":53,"value":499},{"type":48,"tag":237,"props":1827,"children":1828},{"style":249},[1829],{"type":53,"value":1726},{"type":48,"tag":237,"props":1831,"children":1832},{"style":255},[1833],{"type":53,"value":1834},"IOCs CSV",{"type":48,"tag":237,"props":1836,"children":1837},{"style":249},[1838],{"type":53,"value":1736},{"type":48,"tag":237,"props":1840,"children":1841},{"style":1739},[1842],{"type":53,"value":1742},{"type":48,"tag":237,"props":1844,"children":1845},{"style":249},[1846],{"type":53,"value":1747},{"type":48,"tag":237,"props":1848,"children":1849},{"style":243},[1850],{"type":53,"value":1851}," — spreadsheet-friendly\n",{"type":48,"tag":237,"props":1853,"children":1854},{"class":239,"line":621},[1855,1859,1863,1868,1872,1876,1880],{"type":48,"tag":237,"props":1856,"children":1857},{"style":249},[1858],{"type":53,"value":499},{"type":48,"tag":237,"props":1860,"children":1861},{"style":249},[1862],{"type":53,"value":1726},{"type":48,"tag":237,"props":1864,"children":1865},{"style":255},[1866],{"type":53,"value":1867},"Timeline JSON",{"type":48,"tag":237,"props":1869,"children":1870},{"style":249},[1871],{"type":53,"value":1736},{"type":48,"tag":237,"props":1873,"children":1874},{"style":1739},[1875],{"type":53,"value":1742},{"type":48,"tag":237,"props":1877,"children":1878},{"style":249},[1879],{"type":53,"value":1747},{"type":48,"tag":237,"props":1881,"children":1882},{"style":243},[1883],{"type":53,"value":1884}," — event sequence from CAPE\n",{"type":48,"tag":237,"props":1886,"children":1887},{"class":239,"line":629},[1888,1892,1896,1901,1905,1909],{"type":48,"tag":237,"props":1889,"children":1890},{"style":249},[1891],{"type":53,"value":499},{"type":48,"tag":237,"props":1893,"children":1894},{"style":249},[1895],{"type":53,"value":1726},{"type":48,"tag":237,"props":1897,"children":1898},{"style":255},[1899],{"type":53,"value":1900},"Splunk hunt queries",{"type":48,"tag":237,"props":1902,"children":1903},{"style":249},[1904],{"type":53,"value":1736},{"type":48,"tag":237,"props":1906,"children":1907},{"style":1739},[1908],{"type":53,"value":1742},{"type":48,"tag":237,"props":1910,"children":1911},{"style":249},[1912],{"type":53,"value":1913},">)\n",{"type":48,"tag":237,"props":1915,"children":1916},{"class":239,"line":637},[1917,1921,1925,1930,1934,1938],{"type":48,"tag":237,"props":1918,"children":1919},{"style":249},[1920],{"type":53,"value":499},{"type":48,"tag":237,"props":1922,"children":1923},{"style":249},[1924],{"type":53,"value":1726},{"type":48,"tag":237,"props":1926,"children":1927},{"style":255},[1928],{"type":53,"value":1929},"Elastic hunt queries",{"type":48,"tag":237,"props":1931,"children":1932},{"style":249},[1933],{"type":53,"value":1736},{"type":48,"tag":237,"props":1935,"children":1936},{"style":1739},[1937],{"type":53,"value":1742},{"type":48,"tag":237,"props":1939,"children":1940},{"style":249},[1941],{"type":53,"value":1913},{"type":48,"tag":237,"props":1943,"children":1944},{"class":239,"line":646},[1945,1949,1953,1958,1962,1966],{"type":48,"tag":237,"props":1946,"children":1947},{"style":249},[1948],{"type":53,"value":499},{"type":48,"tag":237,"props":1950,"children":1951},{"style":249},[1952],{"type":53,"value":1726},{"type":48,"tag":237,"props":1954,"children":1955},{"style":255},[1956],{"type":53,"value":1957},"Sentinel KQL queries",{"type":48,"tag":237,"props":1959,"children":1960},{"style":249},[1961],{"type":53,"value":1736},{"type":48,"tag":237,"props":1963,"children":1964},{"style":1739},[1965],{"type":53,"value":1742},{"type":48,"tag":237,"props":1967,"children":1968},{"style":249},[1969],{"type":53,"value":1913},{"type":48,"tag":237,"props":1971,"children":1972},{"class":239,"line":654},[1973,1977,1981,1986,1990,1994,1998],{"type":48,"tag":237,"props":1974,"children":1975},{"style":249},[1976],{"type":53,"value":499},{"type":48,"tag":237,"props":1978,"children":1979},{"style":249},[1980],{"type":53,"value":1726},{"type":48,"tag":237,"props":1982,"children":1983},{"style":255},[1984],{"type":53,"value":1985},"Full pipeline envelope",{"type":48,"tag":237,"props":1987,"children":1988},{"style":249},[1989],{"type":53,"value":1736},{"type":48,"tag":237,"props":1991,"children":1992},{"style":1739},[1993],{"type":53,"value":1742},{"type":48,"tag":237,"props":1995,"children":1996},{"style":249},[1997],{"type":53,"value":1747},{"type":48,"tag":237,"props":1999,"children":2000},{"style":243},[2001],{"type":53,"value":2002}," — all 7 stage outputs merged\n",{"type":48,"tag":237,"props":2004,"children":2005},{"class":239,"line":667},[2006],{"type":48,"tag":237,"props":2007,"children":2008},{"emptyLinePlaceholder":321},[2009],{"type":53,"value":324},{"type":48,"tag":237,"props":2011,"children":2012},{"class":239,"line":713},[2013],{"type":48,"tag":237,"props":2014,"children":2015},{"style":243},[2016],{"type":53,"value":2017},"All links expire in 7 days.\n",{"type":48,"tag":237,"props":2019,"children":2020},{"class":239,"line":722},[2021],{"type":48,"tag":237,"props":2022,"children":2023},{"emptyLinePlaceholder":321},[2024],{"type":53,"value":324},{"type":48,"tag":237,"props":2026,"children":2027},{"class":239,"line":730},[2028,2032],{"type":48,"tag":237,"props":2029,"children":2030},{"style":249},[2031],{"type":53,"value":1631},{"type":48,"tag":237,"props":2033,"children":2034},{"style":270},[2035],{"type":53,"value":2036},"Stage-by-stage comments\n",{"type":48,"tag":237,"props":2038,"children":2039},{"class":239,"line":743},[2040,2044,2048,2053,2058,2063],{"type":48,"tag":237,"props":2041,"children":2042},{"style":249},[2043],{"type":53,"value":499},{"type":48,"tag":237,"props":2045,"children":2046},{"style":249},[2047],{"type":53,"value":1726},{"type":48,"tag":237,"props":2049,"children":2050},{"style":255},[2051],{"type":53,"value":2052},"Stage 1 — Triage",{"type":48,"tag":237,"props":2054,"children":2055},{"style":249},[2056],{"type":53,"value":2057},"](",{"type":48,"tag":237,"props":2059,"children":2060},{"style":1739},[2061],{"type":53,"value":2062},"#",{"type":48,"tag":237,"props":2064,"children":2065},{"style":249},[2066],{"type":53,"value":1283},{"type":48,"tag":237,"props":2068,"children":2069},{"class":239,"line":778},[2070,2074,2078,2083,2087,2091],{"type":48,"tag":237,"props":2071,"children":2072},{"style":249},[2073],{"type":53,"value":499},{"type":48,"tag":237,"props":2075,"children":2076},{"style":249},[2077],{"type":53,"value":1726},{"type":48,"tag":237,"props":2079,"children":2080},{"style":255},[2081],{"type":53,"value":2082},"Stage 2 — OSINT recon",{"type":48,"tag":237,"props":2084,"children":2085},{"style":249},[2086],{"type":53,"value":2057},{"type":48,"tag":237,"props":2088,"children":2089},{"style":1739},[2090],{"type":53,"value":2062},{"type":48,"tag":237,"props":2092,"children":2093},{"style":249},[2094],{"type":53,"value":1283},{"type":48,"tag":237,"props":2096,"children":2098},{"class":239,"line":2097},27,[2099,2103,2107,2112,2116,2120],{"type":48,"tag":237,"props":2100,"children":2101},{"style":249},[2102],{"type":53,"value":499},{"type":48,"tag":237,"props":2104,"children":2105},{"style":249},[2106],{"type":53,"value":1726},{"type":48,"tag":237,"props":2108,"children":2109},{"style":255},[2110],{"type":53,"value":2111},"Stage 3 — Static analysis",{"type":48,"tag":237,"props":2113,"children":2114},{"style":249},[2115],{"type":53,"value":2057},{"type":48,"tag":237,"props":2117,"children":2118},{"style":1739},[2119],{"type":53,"value":2062},{"type":48,"tag":237,"props":2121,"children":2122},{"style":249},[2123],{"type":53,"value":1283},{"type":48,"tag":237,"props":2125,"children":2127},{"class":239,"line":2126},28,[2128,2132,2136,2141,2145,2149],{"type":48,"tag":237,"props":2129,"children":2130},{"style":249},[2131],{"type":53,"value":499},{"type":48,"tag":237,"props":2133,"children":2134},{"style":249},[2135],{"type":53,"value":1726},{"type":48,"tag":237,"props":2137,"children":2138},{"style":255},[2139],{"type":53,"value":2140},"Stage 4 — Dynamic analysis",{"type":48,"tag":237,"props":2142,"children":2143},{"style":249},[2144],{"type":53,"value":2057},{"type":48,"tag":237,"props":2146,"children":2147},{"style":1739},[2148],{"type":53,"value":2062},{"type":48,"tag":237,"props":2150,"children":2151},{"style":249},[2152],{"type":53,"value":1283},{"type":48,"tag":237,"props":2154,"children":2156},{"class":239,"line":2155},29,[2157,2161,2165,2170,2174,2178],{"type":48,"tag":237,"props":2158,"children":2159},{"style":249},[2160],{"type":53,"value":499},{"type":48,"tag":237,"props":2162,"children":2163},{"style":249},[2164],{"type":53,"value":1726},{"type":48,"tag":237,"props":2166,"children":2167},{"style":255},[2168],{"type":53,"value":2169},"Stage 5 — Correlation",{"type":48,"tag":237,"props":2171,"children":2172},{"style":249},[2173],{"type":53,"value":2057},{"type":48,"tag":237,"props":2175,"children":2176},{"style":1739},[2177],{"type":53,"value":2062},{"type":48,"tag":237,"props":2179,"children":2180},{"style":249},[2181],{"type":53,"value":1283},{"type":48,"tag":237,"props":2183,"children":2185},{"class":239,"line":2184},30,[2186,2190,2194,2199,2203,2207],{"type":48,"tag":237,"props":2187,"children":2188},{"style":249},[2189],{"type":53,"value":499},{"type":48,"tag":237,"props":2191,"children":2192},{"style":249},[2193],{"type":53,"value":1726},{"type":48,"tag":237,"props":2195,"children":2196},{"style":255},[2197],{"type":53,"value":2198},"Stage 6 — Verdict",{"type":48,"tag":237,"props":2200,"children":2201},{"style":249},[2202],{"type":53,"value":2057},{"type":48,"tag":237,"props":2204,"children":2205},{"style":1739},[2206],{"type":53,"value":2062},{"type":48,"tag":237,"props":2208,"children":2209},{"style":249},[2210],{"type":53,"value":1283},{"type":48,"tag":237,"props":2212,"children":2214},{"class":239,"line":2213},31,[2215],{"type":48,"tag":237,"props":2216,"children":2217},{"emptyLinePlaceholder":321},[2218],{"type":53,"value":324},{"type":48,"tag":237,"props":2220,"children":2222},{"class":239,"line":2221},32,[2223],{"type":48,"tag":237,"props":2224,"children":2225},{"style":243},[2226],{"type":53,"value":2227},"Pipeline complete. Close the issue when findings have been acted on.\n",{"type":48,"tag":62,"props":2229,"children":2231},{"id":2230},"failure-handling",[2232],{"type":53,"value":2233},"Failure handling",{"type":48,"tag":94,"props":2235,"children":2236},{},[2237,2242,2255],{"type":48,"tag":98,"props":2238,"children":2239},{},[2240],{"type":53,"value":2241},"S3 upload fails → retry each file individually; if persistent, fail the stage and post the files inline in the GH comment as fenced blocks (degraded delivery)",{"type":48,"tag":98,"props":2243,"children":2244},{},[2245,2247,2253],{"type":53,"value":2246},"Presigned URL generation fails → post S3 URIs without presigned (",{"type":48,"tag":85,"props":2248,"children":2250},{"className":2249},[],[2251],{"type":53,"value":2252},"s3:\u002F\u002F...",{"type":53,"value":2254},") with a note that the user needs AWS access to download",{"type":48,"tag":98,"props":2256,"children":2257},{},[2258],{"type":53,"value":2259},"DDB write fails → retry 3×, then continue (the artifacts are in S3, that's what matters)",{"type":48,"tag":62,"props":2261,"children":2263},{"id":2262},"guardrails",[2264],{"type":53,"value":2265},"Guardrails",{"type":48,"tag":94,"props":2267,"children":2268},{},[2269,2274,2295,2300],{"type":48,"tag":98,"props":2270,"children":2271},{},[2272],{"type":53,"value":2273},"Link every artifact in the comment. A user who sees \"executive_summary.md generated\" but no link has to dig through S3 themselves — and will ask \"is this even done?\" in a follow-up comment. Link them all.",{"type":48,"tag":98,"props":2275,"children":2276},{},[2277,2279,2285,2287,2293],{"type":53,"value":2278},"Treat prior runs as immutable. If ",{"type":48,"tag":85,"props":2280,"children":2282},{"className":2281},[],[2283],{"type":53,"value":2284},"artifact_id",{"type":53,"value":2286}," is re-analyzed, write under ",{"type":48,"tag":85,"props":2288,"children":2290},{"className":2289},[],[2291],{"type":53,"value":2292},"\u002Freports\u002F\u003Cartifact_id>\u002F\u003Ctimestamp>\u002F",{"type":53,"value":2294}," rather than overwriting. Audit trail and chain-of-custody depend on historical reports staying reproducible.",{"type":48,"tag":98,"props":2296,"children":2297},{},[2298],{"type":53,"value":2299},"Keep the executive summary to 5 sentences. Leadership reads it on a phone; any more and they ask their team to summarize the summary.",{"type":48,"tag":98,"props":2301,"children":2302},{},[2303,2305,2311],{"type":53,"value":2304},"Fill hunt queries with actual IOCs before writing the files. A Splunk query with ",{"type":48,"tag":85,"props":2306,"children":2308},{"className":2307},[],[2309],{"type":53,"value":2310},"hash=\u003Csha256>",{"type":53,"value":2312}," left as a placeholder is net-negative — it gets pasted into production search and returns zero, which looks like \"nothing matches\" rather than a broken query.",{"type":48,"tag":2314,"props":2315,"children":2316},"style",{},[2317],{"type":53,"value":2318},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2320,"total":360},[2321,2338,2351,2367,2376],{"slug":2322,"name":2322,"fn":2323,"description":2324,"org":2325,"tags":2326,"stars":32,"repoUrl":33,"updatedAt":2337},"stage-1-triage","perform initial malware sample triage","Lightweight fingerprinting of a malware sample — hashes, file type, entropy, strings, candidate IOCs. Use this skill whenever you start a 7-stage malware analysis pipeline, need a quick file identification before deeper analysis, or want to check a sample against known-hash databases before committing compute. This is always the first stage and must run before Stage 2 (OSINT), Stage 3 (static), or Stage 4 (dynamic).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2327,2330,2333,2334],{"name":2328,"slug":2329,"type":16},"Code Analysis","code-analysis",{"name":2331,"slug":2332,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":2335,"slug":2336,"type":16},"Triage","triage","2026-08-04T05:58:50.852669",{"slug":2339,"name":2339,"fn":2340,"description":2341,"org":2342,"tags":2343,"stars":32,"repoUrl":33,"updatedAt":2350},"stage-5-correlation","correlate dynamic findings with threat intelligence","Cross-reference dynamic findings against threat intel (MISP, VT, web reporting) + MITRE ATT&CK to derive family + TTPs + campaign linkage. Use this skill whenever you have Stage 4 dynamic observations (C2 IPs, mutexes, injection targets) and want to link them to known campaigns, confirm Stage 2's hypothesis, or produce MITRE TTP IDs with specific per-stage evidence. Runs after Stage 4, or after Stage 3 if Stage 4 was unavailable — can work with partial data. Skip on Stage 2 short-circuit.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2344,2345,2346,2347],{"name":24,"slug":25,"type":16},{"name":2328,"slug":2329,"type":16},{"name":14,"slug":15,"type":16},{"name":2348,"slug":2349,"type":16},"Threat Modeling","threat-modeling","2026-08-04T05:59:09.270695",{"slug":2352,"name":2352,"fn":2353,"description":2354,"org":2355,"tags":2356,"stars":32,"repoUrl":33,"updatedAt":2366},"stage-6-verdict","synthesize security verdicts and recommended actions","Synthesize severity (malicious\u002Fsuspicious\u002Fbenign), confidence (high\u002Fmedium\u002Flow), STIX 2.1 IOC bundle, CSV feed, and concrete recommended actions (host isolation, token revocation, perimeter blocks, fleet-wide hunt queries) from all prior stage envelopes. Use this skill whenever earlier stages have produced findings (or on a Stage 2 short-circuit to benign) and you need a machine-readable verdict that IR teams can ingest into Splunk\u002FElastic\u002FSentinel or block at the perimeter. Always runs — even short-circuits produce a minimal clean-sample verdict. Runs after all other analysis stages; Stage 7 depends on this output.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2357,2358,2359,2362,2365],{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},{"name":2360,"slug":2361,"type":16},"Incident Response","incident-response",{"name":2363,"slug":2364,"type":16},"Policy","policy",{"name":14,"slug":15,"type":16},"2026-08-04T05:59:08.753662",{"slug":4,"name":4,"fn":5,"description":6,"org":2368,"tags":2369,"stars":32,"repoUrl":33,"updatedAt":34},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2370,2371,2372,2373,2374,2375],{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},{"name":27,"slug":28,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":30,"slug":31,"type":16},{"slug":2377,"name":2377,"fn":2378,"description":2379,"org":2380,"tags":2381,"stars":32,"repoUrl":33,"updatedAt":2389},"url-analysis","analyze suspicious URLs in isolated browser sessions","Analyze a suspicious URL by visiting it in an isolated AgentCore Browser\nsession. Captures screenshots, DOM, network requests, redirects, and\nextracted IOCs. Use for phishing triage, suspicious-link investigation,\nand malicious-site fingerprinting.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2382,2385,2386,2387,2388],{"name":2383,"slug":2384,"type":16},"Browser Automation","browser-automation",{"name":2328,"slug":2329,"type":16},{"name":2331,"slug":2332,"type":16},{"name":14,"slug":15,"type":16},{"name":2335,"slug":2336,"type":16},"2026-08-04T05:58:51.393402",{"items":2391,"total":2566},[2392,2410,2431,2441,2454,2467,2477,2487,2508,2521,2536,2551],{"slug":2393,"name":2393,"fn":2394,"description":2395,"org":2396,"tags":2397,"stars":2407,"repoUrl":2408,"updatedAt":2409},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2398,2400,2401,2404],{"name":2399,"slug":921,"type":16},"AWS",{"name":2331,"slug":2332,"type":16},{"name":2402,"slug":2403,"type":16},"Logs","logs",{"name":2405,"slug":2406,"type":16},"Observability","observability",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":2411,"name":2412,"fn":2413,"description":2414,"org":2415,"tags":2416,"stars":2407,"repoUrl":2408,"updatedAt":2430},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2417,2420,2421,2424,2427],{"name":2418,"slug":2419,"type":16},"Aurora","aurora",{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},"Database","database",{"name":2425,"slug":2426,"type":16},"Serverless","serverless",{"name":2428,"slug":2429,"type":16},"SQL","sql","2026-08-04T05:35:10.770847",{"slug":2432,"name":2433,"fn":2413,"description":2414,"org":2434,"tags":2435,"stars":2407,"repoUrl":2408,"updatedAt":2440},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2436,2437,2438,2439],{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},{"name":2425,"slug":2426,"type":16},{"name":2428,"slug":2429,"type":16},"2026-08-04T05:35:05.694395",{"slug":2442,"name":2443,"fn":2413,"description":2414,"org":2444,"tags":2445,"stars":2407,"repoUrl":2408,"updatedAt":2453},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2446,2447,2448,2451,2452],{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},{"name":2449,"slug":2450,"type":16},"Migration","migration",{"name":2425,"slug":2426,"type":16},{"name":2428,"slug":2429,"type":16},"2026-08-04T05:35:08.749669",{"slug":2455,"name":2456,"fn":2413,"description":2414,"org":2457,"tags":2458,"stars":2407,"repoUrl":2408,"updatedAt":2466},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2459,2460,2461,2464,2465],{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},{"name":2462,"slug":2463,"type":16},"PostgreSQL","postgresql",{"name":2425,"slug":2426,"type":16},{"name":2428,"slug":2429,"type":16},"2026-08-04T05:35:06.713102",{"slug":2468,"name":2469,"fn":2413,"description":2414,"org":2470,"tags":2471,"stars":2407,"repoUrl":2408,"updatedAt":2476},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2472,2473,2474,2475],{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},{"name":2425,"slug":2426,"type":16},{"name":2428,"slug":2429,"type":16},"2026-08-04T05:35:10.086942",{"slug":2478,"name":2478,"fn":2413,"description":2414,"org":2479,"tags":2480,"stars":2407,"repoUrl":2408,"updatedAt":2486},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2481,2482,2483,2484,2485],{"name":2399,"slug":921,"type":16},{"name":2422,"slug":2423,"type":16},{"name":2449,"slug":2450,"type":16},{"name":2425,"slug":2426,"type":16},{"name":2428,"slug":2429,"type":16},"2026-08-04T05:35:07.751779",{"slug":2488,"name":2488,"fn":2489,"description":2490,"org":2491,"tags":2492,"stars":2505,"repoUrl":2506,"updatedAt":2507},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2493,2496,2499,2502],{"name":2494,"slug":2495,"type":16},"Accounting","accounting",{"name":2497,"slug":2498,"type":16},"Analytics","analytics",{"name":2500,"slug":2501,"type":16},"Cost Optimization","cost-optimization",{"name":2503,"slug":2504,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":2509,"name":2509,"fn":2510,"description":2511,"org":2512,"tags":2513,"stars":2505,"repoUrl":2506,"updatedAt":2520},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2514,2515,2516,2519],{"name":2399,"slug":921,"type":16},{"name":2503,"slug":2504,"type":16},{"name":2517,"slug":2518,"type":16},"Management","management",{"name":21,"slug":22,"type":16},"2026-07-12T08:40:02.066471",{"slug":2522,"name":2522,"fn":2523,"description":2524,"org":2525,"tags":2526,"stars":2505,"repoUrl":2506,"updatedAt":2535},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2527,2528,2529,2532],{"name":2497,"slug":2498,"type":16},{"name":2503,"slug":2504,"type":16},{"name":2530,"slug":2531,"type":16},"Financial Statements","financial-statements",{"name":2533,"slug":2534,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":2537,"name":2537,"fn":2538,"description":2539,"org":2540,"tags":2541,"stars":2505,"repoUrl":2506,"updatedAt":2550},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2542,2545,2548],{"name":2543,"slug":2544,"type":16},"Automation","automation",{"name":2546,"slug":2547,"type":16},"Documents","documents",{"name":2549,"slug":2537,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":2552,"name":2552,"fn":2553,"description":2554,"org":2555,"tags":2556,"stars":2505,"repoUrl":2506,"updatedAt":2565},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2557,2558,2561,2562],{"name":2494,"slug":2495,"type":16},{"name":2559,"slug":2560,"type":16},"Data Analysis","data-analysis",{"name":2503,"slug":2504,"type":16},{"name":2563,"slug":2564,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",155]