investigate

Conduct an eight-phase investigation for XSOAR, XSIAM, and XDR issues.

Updated Aug 27, 2026

Search Tags:#investigate #pattern-matching #tac #case-analysis #xdr #xsoar #xsiam

Ready to run

npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill investigate-thelightarchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: investigate
Source: https://github.com/theLightArchitect/cappy-toolkit/tree/main/skills/investigate
Command: npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill investigate-thelightarchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

TAC engineers spend excessive time manually gathering logs, searching documentation, and iterating investigations, leading to delays and inconsistent resolutions.

Core Features & Use Cases

Structured eight‑phase workflow covering pre‑flight, triage, evidence analysis, hypothesis generation, validation, solution design, and deliverables.
Automatic pattern database searches, JIRA and case lookups, and evidence correlation.
Human‑in‑the‑loop checkpoints after each phase gate to keep engineers in control.
Applicable to XSOAR, XSIAM, and XDR customer issues, log bundles, HAR files, or symptom descriptions.

Quick Start

Ask CAPPY to investigate case SF‑12345678 or describe the symptom you need help with.

Frequently Asked Questions about investigate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I troubleshoot XSOAR or XSIAM customer cases more efficiently?▼

To troubleshoot XSOAR or XSIAM cases efficiently, apply a structured eight-phase investigation workflow that automates evidence analysis, hypothesis validation, and deliverable generation with human-in-the-loop checkpoints.

What is the structured process for investigating XDR issues from log bundles?▼

Investigating XDR issues from log bundles involves a structured eight-phase process: pre-flight, triage, evidence analysis, hypothesis generation, validation, solution design, and deliverables, utilizing automatic pattern database searches and evidence correlation.

Can I use automated case analysis for HAR files in Palo Alto Networks environments?▼

Yes, you can use automated case analysis for HAR files in Palo Alto Networks environments. The investigation workflow applies to HAR files, log bundles, or symptom descriptions to provide pattern matching and hypothesis validation.

Does the XSOAR investigation workflow include human-in-the-loop checkpoints?▼

Yes, the XSOAR investigation workflow includes human-in-the-loop checkpoints after each phase gate. This ensures engineers maintain control over the triage, evidence analysis, and validation processes throughout the investigation.

What is the best way to validate hypotheses during an XSIAM case investigation?▼

The best way to validate hypotheses during an XSIAM case investigation is using a structured workflow that automatically searches pattern databases, performs JIRA and case lookups, and correlates evidence to confirm or reject hypotheses.

When should I use a structured investigation workflow for XDR troubleshooting?▼

You should use a structured investigation workflow for XDR troubleshooting when TAC engineers spend excessive time manually gathering logs, searching documentation, and iterating investigations, leading to delays and inconsistent resolutions.