Analyze uploaded evidence bundles for TAC investigations using jq, grep, and MCP tools.
npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill evidence
Please help me install this Agent Skill. Skill: evidence Source: https://github.com/theLightArchitect/cappy-toolkit/tree/main/skills/evidence Command: npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill evidence
The evidence skill automates Phase 3 analysis of log bundles, HAR files, and support archives, eliminating manual extraction, grep, and jq chores while ensuring thoroughness and completeness for TAC investigations.
Use case: When a customer reports intermittent API timeouts, the skill extracts the uploaded bundle, scans HAR logs for 5‑second responses, pulls error lines from log files, and checks against known issues, delivering a detailed evidence report ready for the next investigation phase.
Ask the assistant to run the evidence skill on the case directory you uploaded, and it will return a JSON summary of findings and gate status.
High-intent search queries and answers about installing and using this skill.
The evidence skill automates HAR forensics and log mining, parsing HTTP archives to surface errors, slow requests, and authentication issues while building a structured timeline for TAC investigations.
The best way to extract errors from support tarballs is automated bundle extraction followed by log mining with grep to identify errors, timestamps, and stack traces, building a structured timeline without manual scripting.
Yes, you can cross-reference log analysis findings with Cortex documentation, prior TAC cases, and Confluence knowledge bases to contextualize identified errors and patterns for XSOAR, XSIAM, and XDR cases.
Calculate Phase 3 completeness scores by evaluating extracted evidence from log archives and HAR files against the ≥ 80% gate threshold, enforcing progression only when sufficient findings are identified.
Yes, this log analysis approach works with Cortex XSOAR, XSIAM, and XDR cases, applying extraction, pattern matching, and completeness scoring to support tarballs and HAR files across all three platforms.
You do not need jq and grep manually for evidence bundle analysis; the process applies jq, grep, and optional MCP tools internally to perform extraction, pattern matching, and completeness scoring without manual scripting.
rudironsoniAutomate .NET CLI releases with cross-platform builds and package manager distribution.
danielpradillaGenerate PRINCE2 gate briefs summarizing project status, risks, and recommendations.
kimasplundAssess pre-coding confidence with a five-category checklist and verdict.
rileyhilliardAnalyze application logs with grep, awk, sed, and jq to identify errors and patterns.
