skills.rest
lukefitzg
lukefitzgCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

tinysocs-debugging-playbook

Diagnose TinySocs failures with symptom-to-cause triage tables and verified fix pointers.

Updated Oct 12, 2025
Search Tags:#debugging#runbook#triage#powershell#opensearch#detection rules#siem
One-click install
npx skills add https://github.com/lukefitzg/tinysocs --skill tinysocs-debugging-playbook-lukefitzg
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tinysocs-debugging-playbook
Source: https://github.com/lukefitzg/tinysocs/tree/main/.claude/skills/tinysocs-debugging-playbook
Command: npx skills add https://github.com/lukefitzg/tinysocs --skill tinysocs-debugging-playbook-lukefitzg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When a TinySocs deployment misbehaves — a detection rule stays silent, alerts never reach the dashboard, HMAC calls return 401, or a redeployed agent binary doesn't take effect — engineers waste hours reading code before finding the real cause. This Skill provides zero-context triage: each known failure family maps a symptom to the single first command to run, the likely cause, and a verified fix pointer drawn from actual past incidents. ## Core Features & Use Cases - Symptom-to-triage tables: Seven failure families covering silent detection rules, OpenSearch shipper failures, HMAC 401s, dashboard widget/logout bugs, PowerShell 5.1 traps, NSSM respawn races, and federation/ledger issues. - First-check commands: Each row names the one discriminating command to run first (and on which machine), so you discriminate between causes before reading source code. - War-story context: Every family includes the historical incident (with commit SHAs and file:line references) that produced the table, so fixes are grounded in verified root causes rather than guesses. - Use Case: A rule you just tested never produced an alert. Instead of lowering the threshold, you consult family 1, run the grep against packaging/detection/rules.yml, and discover the rule is enabled: false in the pilot pack — or that your test generated fewer events than the threshold, the exact bug fixed in commit 347c98e. ## Quick Start Ask the assistant to triage why a TinySocs detection rule did not fire after running a test attack, and it will walk you through the first-check command, likely cause, and fix pointer.

Frequently Asked Questions about tinysocs-debugging-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why didn't my TinySocs detection rule fire after a test attack?▼

Check three things in order: whether the rule is `enabled: false` in `packaging/detection/rules.yml`, whether your test generated enough events to exceed the rule's threshold within its window_minutes, and whether the rule's group_by field is actually populated by the event source. The playbook's family 1 table maps each case to its fix.

How do I fix OpenSearch connection timeouts in TinySocs?▼

Address OpenSearch at `https://127.0.0.1:9201`, not port 9200 — the plain HTTP listener is not the supported surface and the installer rewrites loopback 9200 URLs to 9201. Verify cluster health with `curl.exe -sk https://127.0.0.1:9201/_cluster/health` before assuming the cluster itself is broken.

Why do TinySocs HMAC calls return 401 between services?▼

401s come from clock skew beyond the 300-second window, a secret mismatch for the specific surface being called (BOT_SHARED_SECRET, NODE_SECRET, or MASTER_SHARED_SECRET), or the per-process replay cache rejecting nonces under multi-worker deployments. The playbook's family 3 table maps each 401 message to its cause.

Why doesn't my redeployed TinySocs agent binary take effect?▼

NSSM respawns TinySocs.Agent.exe on exit, so a taskkill-then-replace races the watchdog and the old binary gets relaunched. Stop the watchdog process, then the NSSM service, in that order, and verify the deploy by reading TinySocsAgent.out.log for the new startup line.

When should I not use this debugging playbook?▼

Use tinysocs-failure-archaeology for full investigation narratives, detection-engineering-reference for threshold and window theory, tinysocs-config-and-flags for env var and port reference, and tinysocs-change-control to decide whether a fix needs sign-off before you make it.

What PowerShell 5.1 issues break TinySocs scripts?▼

Four known traps: non-ASCII characters like em-dashes garble output and swallow statements, Schannel TLS negotiation hangs on self-signed certs (use curl.exe -sk instead), ConvertFrom-Json stalls on large unfiltered _source payloads, and Split-Path on a relative path returns an empty string that breaks Join-Path.

Related Skills

Explore More Software Engineering Skills→
kubespherekubesphere
17.0k

opensearch

Install and configure the OpenSearch extension for KubeSphere observability.

Official
Advanced
supermalangsupermalang

security-audit

Audit modified files for OWASP Top 10 security vulnerabilities and policy violations.

Community
Advanced
nixopusnixopus

pre-deploy-checklist

Validate Dockerfile integrity, port alignment, env vars, health checks, and migration readiness before deployment.

Official
Advanced
Andreicr1Andreicr1

ce-sessions

Analyze coding agent session histories to retrieve insights about past work and investigations.

Community
Intermediate