[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C1R6FT7RPCYXTBB4PST4YQ":3,"skill-same:01M6C1R6FT7RPCYXTBB4PST4YQ":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6C1R6FT7RPCYXTBB4PST4YQ","forensics-investigate",null,"Full multi-agent investigation workflow","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-investigate\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"forensics","investigate","forensics investigate","triage","workflow","cloud","investigation","ssh","multi-agent","container","full","stage","scope","multi","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: forensics-investigate\nplatforms: [all]\ndescription: Full multi-agent investigation workflow\ncommandHint:\n  argumentHint: \"\u003Ctarget> [--scope triage|full|targeted-ssh|container|cloud] [--skip-stage stage]\"\n  category: forensics-investigation\n---\n\n# \u002Fforensics-investigate\n\nOrchestrate a complete digital forensics investigation by coordinating all specialized agents through the full workflow: reconnaissance, triage, acquisition, multi-domain analysis, timeline building, IOC extraction, and report generation. Suitable for incident response and proactive threat hunting.\n\n## Usage\n\n`\u002Fforensics-investigate \u003Ctarget> [options]`\n\n## Arguments\n\n| Argument | Required | Description |\n|----------|----------|-------------|\n| target | Yes | SSH connection string, cloud target, or findings directory path |\n| --scope | No | Investigation scope: `triage`, `full`, `targeted-ssh`, `container`, `cloud` (default: `full`) |\n| --skip-stage | No | Skip a specific stage: `recon`, `triage`, `acquire`, `analysis`, `timeline`, `ioc`, `report` |\n| --resume | No | Resume a previously interrupted investigation from last checkpoint |\n| --output | No | Output directory (default: `.aiwg\u002Fforensics\u002F`) |\n| --parallel | No | Run analysis agents in parallel where possible (default: true) |\n| --notify | No | Webhook URL for stage completion notifications |\n\n## Behavior\n\nWhen invoked, this command:\n\n1. **Initialize Investigation**\n   - Create investigation workspace at `.aiwg\u002Fforensics\u002F`\n   - Assign investigation ID (`INV-\u003Cdate>-\u003Chost>`)\n   - Record start time, investigator, and scope\n   - Check for existing investigation to resume\n\n2. **Reconnaissance (recon-agent)**\n   - Profile target system and establish baseline\n   - Document services, users, and network configuration\n   - Save to `profiles\u002F\u003Chostname>\u002F`\n\n3. **Triage (triage-agent)**\n   - Capture volatile data per RFC 3227 order\n   - Score initial threat level\n   - Identify active indicators requiring immediate attention\n   - Save to `findings\u002F\u003Chostname>\u002Fvolatile\u002F`\n\n4. **Acquisition (forensic-acquisition-agent)**\n   - Collect logs, configurations, and artifacts per triage findings\n   - Establish chain of custody for all evidence\n   - Compute and verify SHA-256 hashes\n   - Save evidence manifest to `acquisition\u002F`\n\n5. **Analysis (parallel agent coordination)**\n   - **Log Analyst**: Auth logs, syslog, journal entries\n   - **Persistence Hunter**: Crons, systemd units, SSH keys, rootkits\n   - **Network Analyst**: Connections, DNS, beaconing, lateral movement\n   - **Container Analyst**: Docker\u002FKubernetes artifacts (if applicable)\n   - **Memory Analyst**: Volatility 3 analysis (if memory image available)\n   - **Cloud Analyst**: CloudTrail, IAM, flow logs (if cloud target)\n   - Save findings to `analysis\u002F\u003Cagent>\u002F`\n\n6. **Timeline Building (timeline-builder)**\n   - Correlate events across all analysis findings\n   - Normalize timestamps to UTC\n   - Reconstruct attack chain with MITRE ATT&CK mapping\n   - Save to `timeline\u002Fincident-timeline.md`\n\n7. **IOC Extraction (ioc-analyst)**\n   - Extract indicators from all findings\n   - Enrich with threat intelligence\n   - Map to STIX 2.1 observables\n   - Save to `ioc\u002Fioc-register.md`\n\n8. **Report Generation (reporting-agent)**\n   - Compile executive summary and technical findings\n   - Include severity-classified evidence table\n   - Generate remediation plan with prioritized actions\n   - Save to `reports\u002Fforensic-report.md`\n\n9. **Quality Gate**\n   - Verify all stages completed or explicitly skipped\n   - Confirm evidence chain of custody integrity\n   - Check report completeness before marking investigation closed\n\n## Profile-to-Plan Generation\n\nWhen a target profile exists at `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002Fsystem-profile.md`, `forensics-investigate` reads it before generating the investigation plan. This enables the plan to contain parameterized, host-specific commands instead of generic placeholders.\n\n### 1. Reading the Target Profile\n\nThe command resolves the profile path from the target argument:\n\n1. Derive hostname from the connection string (e.g., `ssh:\u002F\u002Fadmin@web01` → `web01`)\n2. Scan `.aiwg\u002Fforensics\u002Fprofiles\u002F` for directories matching `\u003Chostname>-*`\n3. Select the most recently dated match (e.g., `web01-2026-02-27\u002F`)\n4. Load `system-profile.md` (human-readable) and `system-profile.json` (machine-readable) from that directory\n5. If no profile is found, log a warning and proceed with an unparameterized plan; prompt the investigator to run `\u002Fforensics-profile` first\n\nThe investigation plan's **Target Profile Reference** section is populated from the resolved path:\n\n```yaml\ntarget_profile_path: .aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002Fsystem-profile.md\nprofile_date: 2026-02-27\n```\n\n### 2. Parameterizing Commands from Profile Data\n\nThe following profile fields are extracted and substituted into investigation plan commands:\n\n| Profile Field | Plan Variable | Example Usage |\n|---------------|---------------|---------------|\n| Hostname | `{{hostname}}` | `last -n 50 web01` |\n| Case ID | `{{case_id}}` | `ps auxf > \u002Ftmp\u002FINV-2026-02-27-web01_ps_snapshot.txt` |\n| Users with shell access | `{{expected_users}}` | Auth log grep patterns scoped to known accounts |\n| Running services list | `{{expected_service_pattern}}` | `lsof -i | grep -v '\u003Cpattern>'` |\n| Listening ports | `{{expected_ports}}` | Connection count alert comparison |\n| Investigation date | `{{investigation_date}}` | `journalctl --since \"2026-02-27 00:00:00\"` |\n| Log lookback window | `{{log_lookback_days}}` | `--since` timestamps for auth and syslog queries |\n| Timeline window | `{{timeline_window_days}}` | `find \u002F -newer` reference marker |\n| Large file threshold | `{{large_file_threshold_mb}}` | `find \u002F -size +100M` |\n| Connection alert threshold | `{{connection_count_alert_threshold}}` | `awk '$1 >= 20'` in network phase |\n| Failed login threshold | `{{failed_login_threshold}}` | Alert threshold in auth analysis |\n| Package manager | `{{package_manager_history_command}}` | Distro-appropriate package history command |\n| Log file paths | `{{web_access_log}}` | Service-specific log path substitution |\n| Evidence storage path | `{{evidence_storage_path}}` | Evidence collection target directory |\n| Escalation contact | `{{escalation_contact}}` | Red flag notification target |\n\nUser and authentication commands in Phase 2 are scoped to the known account list from the profile's **Users with Shell Access** table. For example, if the profile documents `admin`, `deploy`, and `root`, the SSH key sweep is limited to those home directories rather than iterating all of `\u002Fhome`.\n\n### 3. Service-Specific Check Inclusion\n\nPhase 3 (Process and Service Audit) and Phase 7 (Log Analysis) include service-specific checks only for services listed in the profile's **Services and Ports** table with `Expected: Yes`.\n\nThe command applies these rules:\n\n| Service Present in Profile | Checks Included |\n|----------------------------|-----------------|\n| `nginx` or `apache2` | Web access log parsing, HTTP error pattern grep |\n| `mysqld` or `postgresql` | Database error log check, unusual connection sources |\n| `sshd` | SSH auth failure threshold, authorized_keys sweep |\n| `docker` \u002F `containerd` | Phase 8 (Container \u002F Docker Audit) is included; otherwise skipped |\n| No container runtime listed | Phase 8 is excluded from the generated plan with a note |\n| Cloud metadata service detected | Cloud Analyst agent is added to the Phase 5 parallel pool |\n\nThe Phase 8 section header in the generated plan reflects the include\u002Fexclude decision explicitly:\n\n```\n### Phase 8: Container \u002F Docker Audit\n> INCLUDED — docker detected in target profile (3 running containers at baseline)\n```\n\nor:\n\n```\n### Phase 8: Container \u002F Docker Audit\n> SKIPPED — no container runtime in target profile\n```\n\nServices not present in the profile that are found running during triage are flagged as anomalies in the triage summary and receive targeted investigation commands appended to Phase 3.\n\n### 4. Deriving Expected vs. Suspicious Baselines\n\nThe profile's **Services and Ports** and **Network Baseline** sections establish what is normal. The generated plan encodes these baselines directly into triage commands:\n\n**Port baseline** — The expected listening ports from the profile (e.g., `22`, `80`, `443`, `3306`) are embedded in the Phase 6 network check. Any port reported by `ss -tlnpu` that is not in this list is flagged inline:\n\n```bash\n# Ports not in baseline (web01 profile: 22, 80, 443, 3306)\nss -tlnpu | awk 'NR>1 {print $5}' | grep -oP ':\\K[0-9]+' | sort -un \\\n  | grep -vE '^(22|80|443|3306)$' | while read p; do echo \"UNEXPECTED PORT: $p\"; done\n```\n\n**Outbound connection baseline** — The expected outbound destinations from the profile's **Expected Outbound Connections** table are embedded in the network phase as an allowlist. Connections to destinations outside this list are flagged for review.\n\n**User baseline** — The known shell-access accounts from the profile are compared against `getent passwd` output at investigation time. New accounts not in the profile are flagged in Phase 2 as potential persistence artifacts.\n\n**Container baseline** — If the profile includes a **Running Containers (Baseline)** table, the generated plan compares current `docker ps` output against that baseline. Containers not present at profile time are flagged as anomalous in Phase 8.\n\n**Failed login threshold** — The `failed_login_threshold` from the profile's **Investigation Scope Configuration** block (default: `10`) is substituted into the auth log grep commands. Accounts exceeding this threshold in Phase 2 are surfaced as priority findings.\n\n## Scope Profiles\n\n| Scope | Stages | Use Case |\n|-------|--------|----------|\n| `triage` | recon, triage | Initial rapid assessment |\n| `targeted-ssh` | recon, triage, acquire, logs, persistence, network | SSH-compromised host |\n| `container` | recon, triage, acquire, container, network | Container escape or image compromise |\n| `cloud` | recon, acquire, cloud, ioc, report | Cloud account breach |\n| `full` | All stages | Comprehensive incident response |\n\n## Examples\n\n### Example 1: Full investigation\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope full\n```\n\n### Example 2: Quick triage only\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope triage\n```\n\n### Example 3: Container sweep\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Froot@docker-host --scope container\n```\n\n### Example 4: Cloud audit\n```bash\n\u002Fforensics-investigate aws:\u002F\u002F123456789012\u002Fus-east-1 --scope cloud\n```\n\n### Example 5: Resume interrupted investigation\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --resume\n```\n\n### Example 6: Skip memory analysis\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@host --scope full --skip-stage memory\n```\n\n## Output\n\nAll artifacts are saved under `.aiwg\u002Fforensics\u002F`:\n\n```\n.aiwg\u002Fforensics\u002F\n├── investigation.yaml             # Investigation metadata and state\n├── profiles\u002F\n│   └── web01-2026-02-27\u002F\n│       └── system-profile.md\n├── findings\u002F\n│   └── web01-2026-02-27\u002F\n│       ├── triage-summary.md\n│       └── volatile\u002F\n├── acquisition\u002F\n│   ├── evidence-manifest.yaml\n│   └── custody-log.yaml\n├── analysis\u002F\n│   ├── logs\u002F\n│   ├── persistence\u002F\n│   ├── network\u002F\n│   └── ioc\u002F\n├── timeline\u002F\n│   └── incident-timeline.md\n├── ioc\u002F\n│   └── ioc-register.md\n└── reports\u002F\n    └── forensic-report.md\n```\n\n### Sample Progress Output\n\n```\nInvestigation: INV-2026-02-27-web01\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n[14:30:00] Stage 1\u002F8: Reconnaissance     RUNNING\n[14:31:42] Stage 1\u002F8: Reconnaissance     COMPLETE  (102s)\n[14:31:42] Stage 2\u002F8: Triage             RUNNING\n[14:34:15] Stage 2\u002F8: Triage             COMPLETE  (153s) [CRITICAL - active compromise]\n[14:34:15] Stage 3\u002F8: Acquisition        RUNNING\n[14:39:02] Stage 3\u002F8: Acquisition        COMPLETE  (287s) [14 artifacts collected]\n[14:39:02] Stage 4\u002F8: Analysis           RUNNING   (parallel: 5 agents)\n[14:39:02]   Log Analyst                 RUNNING\n[14:39:02]   Persistence Hunter          RUNNING\n[14:39:02]   Network Analyst             RUNNING\n[14:52:18]   Log Analyst                 COMPLETE  [8 findings]\n[14:53:41]   Persistence Hunter          COMPLETE  [3 findings]\n[14:55:09]   Network Analyst             COMPLETE  [5 findings]\n[14:55:09] Stage 4\u002F8: Analysis           COMPLETE  (976s) [16 total findings]\n[14:55:09] Stage 5\u002F8: Timeline           RUNNING\n[14:57:33] Stage 5\u002F8: Timeline           COMPLETE  (144s)\n[14:57:33] Stage 6\u002F8: IOC Extraction     RUNNING\n[14:59:01] Stage 6\u002F8: IOC Extraction     COMPLETE  (88s)  [12 IOCs extracted]\n[14:59:01] Stage 7\u002F8: Report Generation  RUNNING\n[15:01:44] Stage 7\u002F8: Report Generation  COMPLETE  (163s)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nInvestigation Complete: INV-2026-02-27-web01\nDuration: 31m 44s\n\nFindings: 16 total (2 CRITICAL, 5 HIGH, 6 MEDIUM, 3 LOW)\nIOCs: 12 extracted (4 enriched with threat intel)\nReport: .aiwg\u002Fforensics\u002Freports\u002Fforensic-report.md\n```\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Fforensics-orchestrator.md - Orchestrator\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Fmanifest.json - All agent definitions\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-report.md - Report generation\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-status.md - Status monitoring\n","# \u002Fforensics-investigate\n\nOrchestrate a complete digital forensics investigation by coordinating all specialized agents through the full workflow: reconnaissance, triage, acquisition, multi-domain analysis, timeline building, IOC extraction, and report generation. Suitable for incident response and proactive threat hunting.\n\n## Usage\n\n`\u002Fforensics-investigate \u003Ctarget> [options]`\n\n## Arguments\n\n| Argument | Required | Description |\n|----------|----------|-------------|\n| target | Yes | SSH connection string, cloud target, or findings directory path |\n| --scope | No | Investigation scope: `triage`, `full`, `targeted-ssh`, `container`, `cloud` (default: `full`) |\n| --skip-stage | No | Skip a specific stage: `recon`, `triage`, `acquire`, `analysis`, `timeline`, `ioc`, `report` |\n| --resume | No | Resume a previously interrupted investigation from last checkpoint |\n| --output | No | Output directory (default: `.aiwg\u002Fforensics\u002F`) |\n| --parallel | No | Run analysis agents in parallel where possible (default: true) |\n| --notify | No | Webhook URL for stage completion notifications |\n\n## Behavior\n\nWhen invoked, this command:\n\n1. **Initialize Investigation**\n   - Create investigation workspace at `.aiwg\u002Fforensics\u002F`\n   - Assign investigation ID (`INV-\u003Cdate>-\u003Chost>`)\n   - Record start time, investigator, and scope\n   - Check for existing investigation to resume\n\n2. **Reconnaissance (recon-agent)**\n   - Profile target system and establish baseline\n   - Document services, users, and network configuration\n   - Save to `profiles\u002F\u003Chostname>\u002F`\n\n3. **Triage (triage-agent)**\n   - Capture volatile data per RFC 3227 order\n   - Score initial threat level\n   - Identify active indicators requiring immediate attention\n   - Save to `findings\u002F\u003Chostname>\u002Fvolatile\u002F`\n\n4. **Acquisition (forensic-acquisition-agent)**\n   - Collect logs, configurations, and artifacts per triage findings\n   - Establish chain of custody for all evidence\n   - Compute and verify SHA-256 hashes\n   - Save evidence manifest to `acquisition\u002F`\n\n5. **Analysis (parallel agent coordination)**\n   - **Log Analyst**: Auth logs, syslog, journal entries\n   - **Persistence Hunter**: Crons, systemd units, SSH keys, rootkits\n   - **Network Analyst**: Connections, DNS, beaconing, lateral movement\n   - **Container Analyst**: Docker\u002FKubernetes artifacts (if applicable)\n   - **Memory Analyst**: Volatility 3 analysis (if memory image available)\n   - **Cloud Analyst**: CloudTrail, IAM, flow logs (if cloud target)\n   - Save findings to `analysis\u002F\u003Cagent>\u002F`\n\n6. **Timeline Building (timeline-builder)**\n   - Correlate events across all analysis findings\n   - Normalize timestamps to UTC\n   - Reconstruct attack chain with MITRE ATT&CK mapping\n   - Save to `timeline\u002Fincident-timeline.md`\n\n7. **IOC Extraction (ioc-analyst)**\n   - Extract indicators from all findings\n   - Enrich with threat intelligence\n   - Map to STIX 2.1 observables\n   - Save to `ioc\u002Fioc-register.md`\n\n8. **Report Generation (reporting-agent)**\n   - Compile executive summary and technical findings\n   - Include severity-classified evidence table\n   - Generate remediation plan with prioritized actions\n   - Save to `reports\u002Fforensic-report.md`\n\n9. **Quality Gate**\n   - Verify all stages completed or explicitly skipped\n   - Confirm evidence chain of custody integrity\n   - Check report completeness before marking investigation closed\n\n## Profile-to-Plan Generation\n\nWhen a target profile exists at `.aiwg\u002Fforensics\u002Fprofiles\u002F\u003Chostname>-\u003Cdate>\u002Fsystem-profile.md`, `forensics-investigate` reads it before generating the investigation plan. This enables the plan to contain parameterized, host-specific commands instead of generic placeholders.\n\n### 1. Reading the Target Profile\n\nThe command resolves the profile path from the target argument:\n\n1. Derive hostname from the connection string (e.g., `ssh:\u002F\u002Fadmin@web01` → `web01`)\n2. Scan `.aiwg\u002Fforensics\u002Fprofiles\u002F` for directories matching `\u003Chostname>-*`\n3. Select the most recently dated match (e.g., `web01-2026-02-27\u002F`)\n4. Load `system-profile.md` (human-readable) and `system-profile.json` (machine-readable) from that directory\n5. If no profile is found, log a warning and proceed with an unparameterized plan; prompt the investigator to run `\u002Fforensics-profile` first\n\nThe investigation plan's **Target Profile Reference** section is populated from the resolved path:\n\n```yaml\ntarget_profile_path: .aiwg\u002Fforensics\u002Fprofiles\u002Fweb01-2026-02-27\u002Fsystem-profile.md\nprofile_date: 2026-02-27\n```\n\n### 2. Parameterizing Commands from Profile Data\n\nThe following profile fields are extracted and substituted into investigation plan commands:\n\n| Profile Field | Plan Variable | Example Usage |\n|---------------|---------------|---------------|\n| Hostname | `{{hostname}}` | `last -n 50 web01` |\n| Case ID | `{{case_id}}` | `ps auxf > \u002Ftmp\u002FINV-2026-02-27-web01_ps_snapshot.txt` |\n| Users with shell access | `{{expected_users}}` | Auth log grep patterns scoped to known accounts |\n| Running services list | `{{expected_service_pattern}}` | `lsof -i | grep -v '\u003Cpattern>'` |\n| Listening ports | `{{expected_ports}}` | Connection count alert comparison |\n| Investigation date | `{{investigation_date}}` | `journalctl --since \"2026-02-27 00:00:00\"` |\n| Log lookback window | `{{log_lookback_days}}` | `--since` timestamps for auth and syslog queries |\n| Timeline window | `{{timeline_window_days}}` | `find \u002F -newer` reference marker |\n| Large file threshold | `{{large_file_threshold_mb}}` | `find \u002F -size +100M` |\n| Connection alert threshold | `{{connection_count_alert_threshold}}` | `awk '$1 >= 20'` in network phase |\n| Failed login threshold | `{{failed_login_threshold}}` | Alert threshold in auth analysis |\n| Package manager | `{{package_manager_history_command}}` | Distro-appropriate package history command |\n| Log file paths | `{{web_access_log}}` | Service-specific log path substitution |\n| Evidence storage path | `{{evidence_storage_path}}` | Evidence collection target directory |\n| Escalation contact | `{{escalation_contact}}` | Red flag notification target |\n\nUser and authentication commands in Phase 2 are scoped to the known account list from the profile's **Users with Shell Access** table. For example, if the profile documents `admin`, `deploy`, and `root`, the SSH key sweep is limited to those home directories rather than iterating all of `\u002Fhome`.\n\n### 3. Service-Specific Check Inclusion\n\nPhase 3 (Process and Service Audit) and Phase 7 (Log Analysis) include service-specific checks only for services listed in the profile's **Services and Ports** table with `Expected: Yes`.\n\nThe command applies these rules:\n\n| Service Present in Profile | Checks Included |\n|----------------------------|-----------------|\n| `nginx` or `apache2` | Web access log parsing, HTTP error pattern grep |\n| `mysqld` or `postgresql` | Database error log check, unusual connection sources |\n| `sshd` | SSH auth failure threshold, authorized_keys sweep |\n| `docker` \u002F `containerd` | Phase 8 (Container \u002F Docker Audit) is included; otherwise skipped |\n| No container runtime listed | Phase 8 is excluded from the generated plan with a note |\n| Cloud metadata service detected | Cloud Analyst agent is added to the Phase 5 parallel pool |\n\nThe Phase 8 section header in the generated plan reflects the include\u002Fexclude decision explicitly:\n\n```\n### Phase 8: Container \u002F Docker Audit\n> INCLUDED — docker detected in target profile (3 running containers at baseline)\n```\n\nor:\n\n```\n### Phase 8: Container \u002F Docker Audit\n> SKIPPED — no container runtime in target profile\n```\n\nServices not present in the profile that are found running during triage are flagged as anomalies in the triage summary and receive targeted investigation commands appended to Phase 3.\n\n### 4. Deriving Expected vs. Suspicious Baselines\n\nThe profile's **Services and Ports** and **Network Baseline** sections establish what is normal. The generated plan encodes these baselines directly into triage commands:\n\n**Port baseline** — The expected listening ports from the profile (e.g., `22`, `80`, `443`, `3306`) are embedded in the Phase 6 network check. Any port reported by `ss -tlnpu` that is not in this list is flagged inline:\n\n```bash\n# Ports not in baseline (web01 profile: 22, 80, 443, 3306)\nss -tlnpu | awk 'NR>1 {print $5}' | grep -oP ':\\K[0-9]+' | sort -un \\\n  | grep -vE '^(22|80|443|3306)$' | while read p; do echo \"UNEXPECTED PORT: $p\"; done\n```\n\n**Outbound connection baseline** — The expected outbound destinations from the profile's **Expected Outbound Connections** table are embedded in the network phase as an allowlist. Connections to destinations outside this list are flagged for review.\n\n**User baseline** — The known shell-access accounts from the profile are compared against `getent passwd` output at investigation time. New accounts not in the profile are flagged in Phase 2 as potential persistence artifacts.\n\n**Container baseline** — If the profile includes a **Running Containers (Baseline)** table, the generated plan compares current `docker ps` output against that baseline. Containers not present at profile time are flagged as anomalous in Phase 8.\n\n**Failed login threshold** — The `failed_login_threshold` from the profile's **Investigation Scope Configuration** block (default: `10`) is substituted into the auth log grep commands. Accounts exceeding this threshold in Phase 2 are surfaced as priority findings.\n\n## Scope Profiles\n\n| Scope | Stages | Use Case |\n|-------|--------|----------|\n| `triage` | recon, triage | Initial rapid assessment |\n| `targeted-ssh` | recon, triage, acquire, logs, persistence, network | SSH-compromised host |\n| `container` | recon, triage, acquire, container, network | Container escape or image compromise |\n| `cloud` | recon, acquire, cloud, ioc, report | Cloud account breach |\n| `full` | All stages | Comprehensive incident response |\n\n## Examples\n\n### Example 1: Full investigation\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope full\n```\n\n### Example 2: Quick triage only\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --scope triage\n```\n\n### Example 3: Container sweep\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Froot@docker-host --scope container\n```\n\n### Example 4: Cloud audit\n```bash\n\u002Fforensics-investigate aws:\u002F\u002F123456789012\u002Fus-east-1 --scope cloud\n```\n\n### Example 5: Resume interrupted investigation\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@192.168.1.50 --resume\n```\n\n### Example 6: Skip memory analysis\n```bash\n\u002Fforensics-investigate ssh:\u002F\u002Fadmin@host --scope full --skip-stage memory\n```\n\n## Output\n\nAll artifacts are saved under `.aiwg\u002Fforensics\u002F`:\n\n```\n.aiwg\u002Fforensics\u002F\n├── investigation.yaml             # Investigation metadata and state\n├── profiles\u002F\n│   └── web01-2026-02-27\u002F\n│       └── system-profile.md\n├── findings\u002F\n│   └── web01-2026-02-27\u002F\n│       ├── triage-summary.md\n│       └── volatile\u002F\n├── acquisition\u002F\n│   ├── evidence-manifest.yaml\n│   └── custody-log.yaml\n├── analysis\u002F\n│   ├── logs\u002F\n│   ├── persistence\u002F\n│   ├── network\u002F\n│   └── ioc\u002F\n├── timeline\u002F\n│   └── incident-timeline.md\n├── ioc\u002F\n│   └── ioc-register.md\n└── reports\u002F\n    └── forensic-report.md\n```\n\n### Sample Progress Output\n\n```\nInvestigation: INV-2026-02-27-web01\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n[14:30:00] Stage 1\u002F8: Reconnaissance     RUNNING\n[14:31:42] Stage 1\u002F8: Reconnaissance     COMPLETE  (102s)\n[14:31:42] Stage 2\u002F8: Triage             RUNNING\n[14:34:15] Stage 2\u002F8: Triage             COMPLETE  (153s) [CRITICAL - active compromise]\n[14:34:15] Stage 3\u002F8: Acquisition        RUNNING\n[14:39:02] Stage 3\u002F8: Acquisition        COMPLETE  (287s) [14 artifacts collected]\n[14:39:02] Stage 4\u002F8: Analysis           RUNNING   (parallel: 5 agents)\n[14:39:02]   Log Analyst                 RUNNING\n[14:39:02]   Persistence Hunter          RUNNING\n[14:39:02]   Network Analyst             RUNNING\n[14:52:18]   Log Analyst                 COMPLETE  [8 findings]\n[14:53:41]   Persistence Hunter          COMPLETE  [3 findings]\n[14:55:09]   Network Analyst             COMPLETE  [5 findings]\n[14:55:09] Stage 4\u002F8: Analysis           COMPLETE  (976s) [16 total findings]\n[14:55:09] Stage 5\u002F8: Timeline           RUNNING\n[14:57:33] Stage 5\u002F8: Timeline           COMPLETE  (144s)\n[14:57:33] Stage 6\u002F8: IOC Extraction     RUNNING\n[14:59:01] Stage 6\u002F8: IOC Extraction     COMPLETE  (88s)  [12 IOCs extracted]\n[14:59:01] Stage 7\u002F8: Report Generation  RUNNING\n[15:01:44] Stage 7\u002F8: Report Generation  COMPLETE  (163s)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nInvestigation Complete: INV-2026-02-27-web01\nDuration: 31m 44s\n\nFindings: 16 total (2 CRITICAL, 5 HIGH, 6 MEDIUM, 3 LOW)\nIOCs: 12 extracted (4 enriched with threat intel)\nReport: .aiwg\u002Fforensics\u002Freports\u002Fforensic-report.md\n```\n\n## References\n\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Fforensics-orchestrator.md - Orchestrator\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fagents\u002Fmanifest.json - All agent definitions\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-report.md - Report generation\n- @$AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fcommands\u002Fforensics-status.md - Status monitoring\n",{"name":5,"namespace":43,"platforms":44,"commandHint":46,"description":7},"aiwg",[45],"all",{"category":47,"argumentHint":48},"forensics-investigation","\u003Ctarget> [--scope triage|full|targeted-ssh|container|cloud] [--skip-stage stage]","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-investigate",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 21:57:33",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add jmagly\u002Faiwg --skill forensics-investigate",{"tool":65,"command":66},"bunx","bunx skills add jmagly\u002Faiwg --skill forensics-investigate",{"tool":68,"command":69},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill forensics-investigate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fforensics-investigate\u002FSKILL.md",true,[],[74,102,125,131,138,152],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":81,"publishedAt":38},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[80],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101],"host","host hardening","hardening","read","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":112,"publishedAt":38},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[108,111],{"categoryNo":109,"categoryName":110,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,85,116,90,117,118,92,119,82,120,94,121,36,97,98,122,123,124],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","reconstruction","operator","write",{"skillNo":126,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":38},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[129],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[84,82,83,93,85,101,88,87,96,89,90,91,92,100,94,95,86,97,98,99],{"skillNo":132,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":137,"publishedAt":38},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[135,136],{"categoryNo":109,"categoryName":110,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,113,97,116,90,117,92,115,82,120,94,121,36,85,98,119,118,122,123,124],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":38},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,150,151],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":38},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,121,162,147],"pi","pi local","duplicate"]