orca-morning-briefing

Compile critical alerts, attack path changes, and compliance drift into a daily security briefing.

47|7|Updated May 3, 2026

Search Tags:#security #compliance #alerts #exposure #attack-paths #morning-briefing #crown-jewels

Ready to run

npx skills add https://github.com/orcasecurity/orca-skills --skill orca-morning-briefing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: orca-morning-briefing
Source: https://github.com/orcasecurity/orca-skills/tree/main/skills/orca-morning-briefing
Command: npx skills add https://github.com/orcasecurity/orca-skills --skill orca-morning-briefing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Consolidate and present a concise daily security briefing that highlights new critical alerts, attack-path changes, compliance drift, exposure changes, crown jewel risks, and aging unactioned alerts to keep security teams informed with minimal effort.

Core Features & Use Cases

Provides a daily briefing for the last 24-72 hours covering critical alerts, escalations, compliance drift, exposure changes, and aging unactioned alerts.
Highlights crown jewel risks, attack path developments, and CDR activity to guide immediate prioritization.
Supports quick operational reviews and executive summaries, enabling rapid situational awareness.

Quick Start

Ask for the latest morning briefing to see what happened and what needs attention.

Frequently Asked Questions about orca-morning-briefing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a daily security posture briefing for critical alerts and compliance drift?▼

Generate a daily security briefing by compiling new critical alerts, attack path changes, compliance drift, and crown jewel risks into a concise dashboard. It deduplicates alerts by ID and renders drill-down sections for rapid decision making.

What is included in a morning security briefing for cloud accounts?▼

A morning security briefing includes critical and high alerts, attack path developments, exposure changes, compliance drift, crown jewel risks, and aging unactioned alerts across multiple accounts and assets.

Can I summarize security alerts and exposure changes over a 72 hour window?▼

Yes, you can summarize security alerts and exposure changes over custom time windows including 24h, 72h, or weekly intervals. The briefing applies parallel data queries to surface posture changes within the specified period.

How do I track crown jewel risks and attack path changes across accounts?▼

Track crown jewel risks and attack path changes by executing parallel discovery searches across multiple accounts. The briefing surfaces crown jewel risks and attack path developments to guide immediate prioritization.

What is the best way to get an executive summary of compliance drift and aging alerts?▼

Get an executive summary of compliance drift and aging alerts by compiling enabled compliance frameworks, trend data, and grouped CDR events. It supports quick operational reviews and executive summaries for rapid situational awareness.

Does the daily security briefing deduplicate alerts by ID across multiple assets?▼

Yes, the daily security briefing deduplicates alerts by ID across multiple assets and accounts. It executes parallel data queries for alerts, compliance frameworks, and CDR events to ensure accurate reporting.