asp-case-zh

List, review, and update ASP security cases via MCP server operations.

1.1k|201|Updated Sep 7, 2025

Search Tags:#investigation #playbook #mcp #triage #case-management #soc #asp

Ready to run

npx skills add https://github.com/FunnyWolf/agentic-soc-platform --skill asp-case-zh

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: asp-case-zh
Source: https://github.com/FunnyWolf/agentic-soc-platform/tree/main/PLUGINS/ClaudeCode/skills/asp-case-zh
Command: npx skills add https://github.com/FunnyWolf/agentic-soc-platform --skill asp-case-zh

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

管理 ASP 安全 case。适用于审查 case、列出 case、查看 case 讨论、检查 case 相关告警或 playbook run，或更新 case 工作流和 AI 分析字段。

Core Features & Use Cases

以 case 为核心的 SOC 工作流管理，简化审查、筛选、讨论查看与自动化字段更新。
集中查看 related alerts、playbook runs 和 case 讨论，提升协同效率与追踪能力。
支持将 enrichment 或结构化分析回写到 case，驱动后续分析与自动化。

Quick Start

输入 review case <case_id> 来快速开始对指定 case 的审查与处理。

Frequently Asked Questions about asp-case-zh

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate ASP case management for SOC workflows?▼

You can automate ASP case management using an MCP server integration to list, review, and update security incidents. The workflow supports filtering cases by status, severity, or verdict, and viewing related alerts and playbook runs.

How do I review a specific security case and its related alerts?▼

Review a specific security case by inputting the case ID to retrieve related alerts, playbook runs, and discussion threads. This centralizes triage information for security incident analysis and collaborative tracking.

Do I need an MCP server to manage ASP cases?▼

Yes, an MCP server integration is required to execute ASP case-based operations. The MCP server enables listing cases, updating workflows, viewing discussions, and executing playbooks for SOC triage.

Can I filter security cases by severity and verdict during triage?▼

Yes, you can filter security cases by status, severity, or verdict during triage. This filtering capability helps SOC analysts prioritize incidents and focus on high-risk security events requiring immediate review.

How do I update AI analysis fields and enrichment data on a case?▼

Update AI analysis fields and enrichment data on a case using the update_case operation. This allows you to write structured analysis back to the case, driving subsequent automated workflows and investigations.

What is the best way to execute playbooks during incident triage?▼

The best way to execute playbooks during incident triage is through the execute_playbook operation integrated within ASP case management. This automates response actions and links playbook runs directly to the active case.