investigation-query

Query investigation wiki pages and spreadsheets for case status and findings.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/mgreen27/dfir-skills --skill investigation-query
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: investigation-query
Source: https://github.com/mgreen27/dfir-skills/tree/main/skills/investigation-query
Command: npx skills add https://github.com/mgreen27/dfir-skills --skill investigation-query

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables users to efficiently query investigation-centric documentation and spreadsheets to understand case status and findings without manually reviewing raw artifacts.

Core Features & Use Cases

  • Case Question Answering: Retrieve insights from the investigation wiki and Spreadsheet of Doom to answer case-related questions.
  • Progress Review: Assess current case status, recent leads, and unresolved issues to prioritize next steps.
  • Use Case: An analyst wants to review the latest findings and case timeline to prepare for an stakeholder update. They run this Skill with a focus on the analysis page and timeline CSV records.

Quick Start

Ask the AI to answer a specific question about the investigation's current status or recent activity based on the wiki and case spreadsheet data.

Frequently Asked Questions about investigation-query

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query investigation case notes and spreadsheets to retrieve case status?

You query investigation case notes and spreadsheets for case status by asking the AI a specific question about your wiki pages and case records. It retrieves relevant data to support incident response workflows.

What is the best way to review recent leads and unresolved issues from an incident response wiki?

The best way to review recent leads and unresolved issues from an incident response wiki is to run this Skill with a focus on the analysis page and timeline records. It assesses current case status to prioritize next steps.

Can I analyze timeline CSV records and hierarchical case information together?

Yes, you can analyze timeline CSV records and hierarchical case information together. The Skill works within existing wiki pages and spreadsheet records to handle timelines and synthesize key findings for case management.

Does this case query approach work without manually reviewing raw investigation artifacts?

Yes, this case query approach works without manually reviewing raw investigation artifacts. It enables users to query investigation-centric documentation and spreadsheets to understand case status and findings directly.

What do I need to prepare for incident response case query and documentation analysis?

To prepare for incident response case query and documentation analysis, you need existing wiki pages containing case notes and a populated case spreadsheet. The Skill queries these artifacts to retrieve insights without manual review.