recon

Validate Phase 4 hypotheses against customer deployment environments using logs and tickets.

Updated Aug 27, 2026

Search Tags:#architecture #validation #environment #jira #confluence #hypothesis #recon

Ready to run

npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill recon-thelightarchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon
Source: https://github.com/theLightArchitect/cappy-toolkit/tree/main/skills/recon
Command: npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill recon-thelightarchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps TAC engineers ensure that a Phase 4 hypothesis about a Cortex/XSOAR/XDR deployment aligns with the customer's real environment, preventing wasted effort on incorrect assumptions.

Core Features & Use Cases

Environment-alignment validation: compares hypothesis against customer topology, product version, build, and architecture.
Data triangulation: pulls evidence from env logs, JIRA tickets, Cortex docs, and Confluence to corroborate environmental details.
Iterative decision support: flags mismatches with actionable recommendations to refine hypotheses or explore alternate configurations.
Phase 5 readiness: accelerates correct scoping by surfacing required details before deeper investigation.

Quick Start

Run recon to verify your Phase 4 hypothesis matches the customer's actual deployment topology, product version, and infrastructure constraints.

Frequently Asked Questions about recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate a Cortex XSOAR hypothesis against a customer's actual deployment environment?▼

Validate a Cortex XSOAR deployment hypothesis by comparing it against the customer's actual topology, product version, and infrastructure constraints using environment logs, JIRA tickets, Cortex docs, and Confluence data.

What is environment-alignment validation for XDR deployment investigations?▼

Environment-alignment validation is the process of verifying that a Phase 4 investigation hypothesis matches the customer's real XDR deployment architecture, build, and product version before deeper analysis.

Can I use JIRA and Confluence data to verify XSIAM deployment topology assumptions?▼

Yes, you can triangulate evidence from JIRA tickets and Confluence alongside environment logs and Cortex docs to corroborate XSIAM deployment topology details and flag assumption mismatches.

What's the best way to prevent wasted effort on incorrect XSOAR deployment assumptions?▼

Prevent wasted effort by running environment reconnaissance to surface mismatches between your hypothesis and the actual deployment, providing actionable recommendations to refine hypotheses or explore alternate configurations.

When do I need to check infrastructure constraints during a Cortex XDR investigation?▼

Check infrastructure constraints during Phase 4 investigations to ensure correct scoping before Phase 5, accelerating readiness by validating that your hypothesis aligns with the actual deployment environment.