skills.rest
orcasecurity
orcasecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

orca-alert-triage

Convert Orca Security alerts into triage summaries with timelines and risk assessments.

47|7|Updated May 3, 2026
Search Tags:#timeline#mcp#risk-assessment#triage#blast-radius#orca-alerts
One-click install
npx skills add https://github.com/orcasecurity/orca-skills --skill orca-alert-triage
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: orca-alert-triage
Source: https://github.com/orcasecurity/orca-skills/tree/main/skills/orca-alert-triage
Command: npx skills add https://github.com/orcasecurity/orca-skills --skill orca-alert-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzes Orca Security alerts to produce analyst-friendly triage summaries with timeline visualizations, risk scoring, and actionable guidance.

Core Features & Use Cases

  • Fetches alert data via MCP, identifies category, and constructs a concise verdict.
  • Builds a behavioral timeline and blast-radius context to support incident response.
  • Provides progressive disclosure sections (investigation, evidence, remediation, correlation) upon request to facilitate deep dives.

Quick Start

Triaging a specific Orca alert by ID (e.g., 'orca-3636513') yields a structured, timeline-based summary.

Frequently Asked Questions about orca-alert-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage Orca Security alerts with a timeline and risk assessment?▼

To triage Orca Security alerts, this Skill fetches alert data via MCP, constructs a concise verdict, and builds a behavioral timeline with blast-radius context to support quick investigation and remediation decisions.

What is the best way to get a blast-radius summary for an Orca alert?▼

Getting an Orca alert blast-radius summary involves analyzing the alert across production environments and asset contexts, then structuring the output with a verdict and progressive disclosure follow-ups to reveal the full impact scope.

Can I use this to generate analyst-friendly incident response summaries for Orca alerts?▼

Yes, you can generate analyst-friendly incident response summaries by triaging a specific Orca alert by ID, which yields a structured, timeline-based summary with risk scoring and actionable remediation guidance.

Does triaging Orca alerts by ID require additional dependencies or components?▼

Triaging Orca alerts by ID requires no additional dependencies or components. The Skill operates independently to fetch alert data via MCP and format the structured triage output according to MCP data requirements.

How do I access remediation and evidence details after the initial Orca alert triage?▼

After the initial Orca alert triage, you access remediation and evidence details through progressive disclosure sections. These follow-ups facilitate deep dives into investigation, evidence, remediation, and correlation data.

Related Skills

Explore More Data & Analytics Skills→
FunnyWolfFunnyWolf
1.1k

asp-alert-zh

Review ASP alerts by ID and update AI analysis fields.

Community
Intermediate
idchain-worldidchain-world
16

differential-review

Automate security-focused differential reviews of code changes with markdown reports.

Official
Advanced
aivos-xieaivos-xie
1

digital-forensics

Analyze disk, memory, and network data for digital forensics investigations.

Community
Advanced
EuraxluoEuraxluo

csv-data-summarizer

Analyze CSV datasets to generate statistical summaries and visualizations.

Community
Intermediate