Agent skill

Full Alert Triage

Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks.

Apache-2.0Auto-check passedSecurity

Install Full Alert Triage

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/_workflows/full-alert-triage .claude/skills/full-alert-triage && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .claude/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/_workflows/full-alert-triage .agents/skills/full-alert-triage && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .agents/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/_workflows/full-alert-triage .cursor/skills/full-alert-triage && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .cursor/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/dandye/ai-runbooks.git --path skills/_workflows/full-alert-triage

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/_workflows/full-alert-triage .gemini/skills/full-alert-triage && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .gemini/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/_workflows/full-alert-triage .github/skills/full-alert-triage && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .github/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add dandye/ai-runbooks --skill full-alert-triage -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks full-alert-triage --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/_workflows/full-alert-triage .opencode/skills/full-alert-triage && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "full-alert-triage" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/_workflows/full-alert-triage into .opencode/skills/full-alert-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "full-alert-triage", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: full-alert-triage
GitHub stars: 127
Token cost: ~1.8k tokens
SKILL.md length: 400 words
Files: 1
Skills in repo: 27
Repo updated: Aug 14, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks.

Works in 5 steps: Pre-Check → Initial Triage → Enrichment → …
End-to-end alert processing
SKILL.md covers Inputs, Orchestrated Workflow, Detailed Steps and Outputs, plus 2 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Full Alert Triage is an agent skill from dandye/ai-runbooks. Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Security operations. The licence is Apache-2.0.

When your agent uses it

End-to-end alert processing
Tasks that involve Security operations

Example prompts

“/full-alert-triage”

Workflow steps

5 steps, taken from the step headings in SKILL.md.

Pre-Check
Initial Triage
Enrichment
Decision & Action
Report

What it can do on your machine

Read from SKILL.md and the folder at commit 72a6863. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Full Alert Triage loads about 1.8k tokens when it runs. Until then it costs about 62 tokens; SKILL.md has 400 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~62
When it runs · the whole SKILL.md, loaded when a task matches: ~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from dandye/ai-runbooks at commit 72a6863, republished under its Apache-2.0 licence (© dandye). 400 words, ~1,849 tokens.

Download SKILL.mdSave it as .claude/skills/full-alert-triage/SKILL.md (or your agent's skills folder).

name: full-alert-triage
description: Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.
type: workflow
orchestrates: check-duplicates, triage-alert, enrich-ioc, document-in-case, close-case-artifact
required_roles.chronicle: roles/chronicle.viewer
required_roles.soar: roles/chronicle.editor
required_roles.gti: GTI Standard
personas: tier1-analyst
generated.by: human:dandye
generated.at: 2026-02-04T06:27:43-05:00

Full Alert Triage Workflow

A composite skill that orchestrates the complete Tier 1 alert triage process from initial receipt to disposition (close or escalate).

Inputs

CASE_ID or ALERT_ID - The alert/case to triage (required)

Orchestrated Workflow

┌─────────────────────────────────────────────────────────────────┐
│                    FULL ALERT TRIAGE                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  START                                                          │
│    │                                                            │
│    ▼                                                            │
│  ┌─────────────────────┐                                        │
│  │  /check-duplicates  │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────┐                                           │
│     ▼               ▼                                           │
│  DUPLICATE       NOT DUPLICATE                                  │
│     │               │                                           │
│     ▼               ▼                                           │
│  Close &      ┌─────────────────────┐                           │
│  Document     │   /triage-alert     │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │         ┌───────────┴─────────┐                           │
│     │         │  For each entity:   │                           │
│     │         │    /enrich-ioc      │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │         ┌───────────┴─────────┐                           │
│     │         │     DECISION        │                           │
│     │         └───────────┬─────────┘                           │
│     │                     │                                     │
│     │     ┌───────────────┼────────────────┐                    │
│     │     ▼               ▼                ▼                    │
│     │   FP/BTP         TP/Suspicious    Inconclusive            │
│     │     │                  │                  │               │
│     │     ▼                  ▼                  ▼               │
│     │  /document-in-case    /document-in-case /document-in-case │
│     │  /close-case-artifact  ESCALATE         Request more info │
│     │     │                  │                  │               │
│     └─────┴──────────────────┴──────────────────┘               │
│                    │                                            │
│                    ▼                                            │
│               /generate-report                                  │
│                    │                                            │
│                    ▼                                            │
│                  END                                            │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Detailed Steps

Phase 1: Pre-Check

Step 1.1: Check for Duplicates

Invoke: /check-duplicates CASE_ID=$CASE_ID

If duplicate confirmed:
- Invoke: /document-in-case with "Closing as duplicate of [Similar Case ID]"
- Invoke: /close-case-artifact with reason NOT_MALICIOUS
- END WORKFLOW
If not duplicate: Continue to Phase 2

Phase 2: Initial Triage

Step 2.1: Perform Alert Triage

Invoke: /triage-alert CASE_ID=$CASE_ID

Extract from results:

CLASSIFICATION - FP, BTP, TP, or Suspicious
KEY_ENTITIES - List of IOCs (IPs, domains, hashes, URLs)
ALERT_TYPE - Type of alert (malware, authentication, network, etc.)
PRIORITY - Suggested priority level

Phase 3: Enrichment

Step 3.1: Enrich Each Entity

For each entity in KEY_ENTITIES:

Invoke: /enrich-ioc IOC_VALUE=$entity

Collect:

GTI_FINDINGS - Threat intelligence results
SIEM_CONTEXT - SIEM entity summary
IOC_MATCH_STATUS - Whether IOC appears in threat feeds

Update CLASSIFICATION if enrichment reveals new information.

Phase 4: Decision & Action

Step 4.1: Make Final Classification

Based on triage and enrichment, confirm classification:

Classification	Criteria	Action
False Positive (FP)	No malicious indicators, known benign	Close
Benign True Positive (BTP)	Real but authorized/expected	Close
True Positive (TP)	Confirmed malicious	Escalate
Suspicious	Inconclusive, warrants investigation	Escalate

Step 4.2: Execute Disposition

If FP or BTP:

Invoke: /document-in-case with:
- Classification and rationale
- Evidence summary from enrichment
- Closure justification
Invoke: /close-case-artifact with:
- Reason: NOT_MALICIOUS
- Root cause: Appropriate option (e.g., "Legit action", "Normal behavior")

If TP or Suspicious:

Invoke: /document-in-case with:
- Classification and rationale
- Evidence summary
- Recommended next steps
Output escalation recommendation:
- Escalate to Tier 2
- Suggest appropriate follow-up skill based on alert type:
  - Malware → /triage-malware
  - Authentication → /triage-suspicious-login
  - IOC-focused → /deep-dive-ioc

Show full SKILL.md (124 more words)Show less

Phase 5: Report

Step 5.1: Generate Triage Report

Invoke: /generate-report REPORT_TYPE=triage

Include:

Case/Alert ID
Classification with rationale
Key entities and enrichment results
SIEM queries executed
Disposition taken
Next steps (if escalated)

Outputs

Output	Description
`FINAL_CLASSIFICATION`	FP, BTP, TP, or Suspicious
`DISPOSITION`	Closed or Escalated
`EVIDENCE_SUMMARY`	Key findings from triage and enrichment
`REPORT_PATH`	Path to generated triage report
`ESCALATION_TARGET`	If escalated, recommended next skill/tier

Error Handling

If /check-duplicates fails → Log warning, continue with triage
If /enrich-ioc fails for an entity → Log warning, continue with other entities
If /close-case-artifact fails → Log error, manual closure required
If any MCP tool unavailable → Document limitation, proceed with available data

Performance Targets

Total workflow time: < 15 minutes
Duplicate detection: < 1 minute
Per-entity enrichment: < 2 minutes
Target accuracy: > 90% correct classification

Files

Just SKILL.md in skills/_workflows/full-alert-triage of dandye/ai-runbooks.

Open the folder on GitHubat commit 72a6863

Compare with similar skills

Full Alert Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Full Alert Triage compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Full Alert Triage this skilldandye/ai-runbooks	127	—	~1.8k	Automated safety check: Pass	Apache-2.0	1 mo ago
Security Alert Triageelastic/agent-skills	592	1 repos	~3.5k	Automated safety check: Notes	Apache-2.0	3 days ago
Kubernetes Network Security Auditkubeshark/kubeshark	12k	—	~7.3k	Automated safety check: Notes	Apache-2.0	yesterday
Security Detection Rule Managementelastic/agent-skills	592	1 repos	~3.9k	Automated safety check: Notes	Apache-2.0	3 days ago
Chaitin CLIchaitin/chaitin-cli	115	—	~15k	Automated safety check: Notes	GPL-3.0	12 days ago
GatesNebulock-Inc/agentic-threat-hunting-framework	388	—	~12k	Automated safety check: Pass	MIT	2 days ago

Similar skills

Security Alert Triage
elastic/agent-skills
Official
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
592 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check: notes
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
12k GitHub stars~7.3k tokensUpdated yesterday
SecurityAuto-check: notes
Security Detection Rule Management
elastic/agent-skills
Official
Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).
592 GitHub starsUsed in 1 repo~3.9k tokens
SecurityAuto-check: notes
Chaitin CLI
chaitin/chaitin-cli
A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…
115 GitHub stars~15k tokensUpdated 12 days ago
SecurityAuto-check: notes
Gates
Nebulock-Inc/agentic-threat-hunting-framework
GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.
388 GitHub stars~12k tokensUpdated 2 days ago
SecurityAuto-check passed
Elasticsearch Audit
aspectrr/deer
Enable, configure, and query Elasticsearch security audit logs.
405 GitHub stars~1.7k tokensUpdated 5 mo ago
SecurityAuto-check passed

Questions about Full Alert Triage

What does Full Alert Triage do?

Complete Tier 1 triage workflow. An agent skill from dandye/ai-runbooks. Full Alert Triage is an agent skill from dandye/ai-runbooks. Complete Tier 1 triage workflow.

When should I use Full Alert Triage?

Full Alert Triage fits situations like: end-to-end alert processing; tasks that involve Security operations.

How do I install Full Alert Triage in Claude Code?

Run `npx skills add dandye/ai-runbooks --skill full-alert-triage -a claude-code`. Or copy the skill folder (skills/_workflows/full-alert-triage in dandye/ai-runbooks) into .claude/skills/full-alert-triage in your project. Claude Code loads it when a task matches its description.

How do I install Full Alert Triage in Codex?

Run `npx skills add dandye/ai-runbooks --skill full-alert-triage -a codex`. Or copy the skill folder (skills/_workflows/full-alert-triage in dandye/ai-runbooks) into .agents/skills/full-alert-triage in your project. Codex loads it when a task matches its description.

Can I use Full Alert Triage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add dandye/ai-runbooks --skill full-alert-triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/full-alert-triage, .gemini/skills/full-alert-triage, .github/skills/full-alert-triage and .opencode/skills/full-alert-triage in your project.

What does Full Alert Triage need to run?

SKILL.md names no scripts, command-line tools or credentials: Full Alert Triage is instructions for the agent only.

Does Full Alert Triage access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Full Alert Triage safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Full Alert Triage use?

Full Alert Triage is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Full Alert Triage use?

About 1.8k tokens (SKILL.md is roughly 7.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Full Alert Triage?

Skills that share tags, products or a category with Full Alert Triage: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Chaitin CLI (chaitin/chaitin-cli, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Full Alert Triage?

dandye (a GitHub user) maintains it in dandye/ai-runbooks, which has 127 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on August 14, 2026.

Source: dandye/ai-runbooks on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Full Alert Triage

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Full Alert Triage Workflow

Inputs

Orchestrated Workflow

Detailed Steps

Phase 1: Pre-Check

Phase 2: Initial Triage

Phase 3: Enrichment

Phase 4: Decision & Action

Phase 5: Report

Outputs

Error Handling

Performance Targets

Files

Compare with similar skills

Similar skills

More from dandye/ai-runbooks

Related

Questions about Full Alert Triage