[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVG8RNZVYVG1GG8WNMBB4S":3,"skill-same:01M6EVG8RNZVYVG1GG8WNMBB4S":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6EVG8RNZVYVG1GG8WNMBB4S","implementing-ticketing-system-for-incidents",null,"Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"system","implementing ticketing system for incidents","ticketing","servicenow","de","ticket","creation","alerts","incident","cm","thehive","cybersecurity","t1566","t1078","soc","jira","documentation","workflows","workflow","siem","2026-11-10 10:12:30",false,"---\nname: implementing-ticketing-system-for-incidents\ndescription: 'Implements an integrated incident ticketing system connecting SIEM alerts\n  to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management,\n  escalation workflows, and compliance documentation. Use when SOC teams need formalized\n  incident lifecycle management with automated ticket creation, assignment routing,\n  and resolution tracking.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- ticketing\n- servicenow\n- jira\n- thehive\n- incident-management\n- sla\n- workflow\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n# Implementing Ticketing System for Incidents\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to formalize incident tracking beyond SIEM notable event management\n- Compliance requirements mandate documented incident lifecycle with timestamps and audit trails\n- Multi-team coordination requires ticket-based workflows with assignment and escalation\n- SLA tracking needs automated measurement of response and resolution times\n- Post-incident reviews require structured data for trend analysis and reporting\n\n**Do not use** for individual alert triage — ticketing is for confirmed incidents requiring multi-step investigation and remediation, not every SIEM alert.\n\n## Prerequisites\n\n- Ticketing platform: ServiceNow ITSM, Jira Service Management, or TheHive\n- SIEM integration capability (REST API, webhook, or SOAR connector)\n- Incident classification taxonomy (categories, severity levels, escalation paths)\n- On-call rotation schedule for analyst assignment\n- SLA definitions aligned to incident severity\n\n## Workflow\n\n### Step 1: Define Incident Classification Taxonomy\n\nEstablish standardized incident categories and severity:\n\n```yaml\nincident_taxonomy:\n  categories:\n    - malware_infection\n    - phishing_campaign\n    - unauthorized_access\n    - data_exfiltration\n    - denial_of_service\n    - ransomware\n    - insider_threat\n    - vulnerability_exploitation\n    - account_compromise\n    - policy_violation\n\n  severity_levels:\n    critical:\n      definition: \"Active data breach, ransomware, or business-critical system compromise\"\n      response_sla: 15 minutes\n      resolution_sla: 4 hours\n      escalation: immediate to Tier 3 + CISO notification\n      examples: [\"Active ransomware\", \"Domain admin compromise\", \"Customer data breach\"]\n\n    high:\n      definition: \"Confirmed compromise of business systems or multiple user accounts\"\n      response_sla: 30 minutes\n      resolution_sla: 8 hours\n      escalation: Tier 2 immediate, Tier 3 if unresolved in 2 hours\n      examples: [\"Malware with C2\", \"Lateral movement detected\", \"Phishing with credential theft\"]\n\n    medium:\n      definition: \"Confirmed security event requiring investigation and remediation\"\n      response_sla: 2 hours\n      resolution_sla: 24 hours\n      escalation: Tier 2 within 4 hours\n      examples: [\"Single phishing click\", \"Unauthorized software\", \"Policy violation\"]\n\n    low:\n      definition: \"Minor security event with limited impact\"\n      response_sla: 8 hours\n      resolution_sla: 72 hours\n      escalation: Tier 1 standard queue\n      examples: [\"Scan attempt\", \"Failed brute force (no compromise)\", \"Info disclosure\"]\n```\n\n### Step 2: Automate Ticket Creation from SIEM\n\n**ServiceNow Integration via REST API:**\n\n```python\nimport requests\nimport json\nfrom datetime import datetime\n\nclass IncidentTicketManager:\n    def __init__(self, snow_url, snow_user, snow_password):\n        self.snow_url = snow_url\n        self.auth = (snow_user, snow_password)\n        self.headers = {\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\"\n        }\n\n    def create_incident(self, alert_data):\n        \"\"\"Create ServiceNow incident from SIEM alert\"\"\"\n        severity_map = {\n            \"critical\": \"1\",\n            \"high\": \"2\",\n            \"medium\": \"3\",\n            \"low\": \"4\"\n        }\n\n        payload = {\n            \"short_description\": f\"[SEC] {alert_data['rule_name']} — {alert_data['src']}\",\n            \"description\": self._build_description(alert_data),\n            \"category\": \"Security\",\n            \"subcategory\": alert_data.get(\"category\", \"Investigation\"),\n            \"urgency\": severity_map.get(alert_data[\"severity\"], \"3\"),\n            \"impact\": severity_map.get(alert_data[\"severity\"], \"3\"),\n            \"assignment_group\": self._get_assignment_group(alert_data[\"severity\"]),\n            \"caller_id\": \"soc_automation\",\n            \"u_siem_event_id\": alert_data.get(\"notable_id\", \"\"),\n            \"u_mitre_technique\": alert_data.get(\"mitre_technique\", \"\"),\n            \"u_affected_hosts\": \", \".join(alert_data.get(\"affected_hosts\", [])),\n            \"u_iocs\": json.dumps(alert_data.get(\"iocs\", {}))\n        }\n\n        response = requests.post(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\",\n            auth=self.auth,\n            headers=self.headers,\n            json=payload\n        )\n        result = response.json()[\"result\"]\n        return {\n            \"ticket_number\": result[\"number\"],\n            \"sys_id\": result[\"sys_id\"],\n            \"state\": result[\"state\"]\n        }\n\n    def _build_description(self, alert_data):\n        return f\"\"\"\nSECURITY INCIDENT — Auto-generated from SIEM\n================================================\nAlert Rule:       {alert_data['rule_name']}\nSIEM Event ID:    {alert_data.get('notable_id', 'N\u002FA')}\nDetection Time:   {alert_data['detection_time']}\nSeverity:         {alert_data['severity'].upper()}\nMITRE ATT&CK:    {alert_data.get('mitre_technique', 'N\u002FA')}\n\nSource:           {alert_data.get('src', 'N\u002FA')}\nDestination:      {alert_data.get('dest', 'N\u002FA')}\nUser:             {alert_data.get('user', 'N\u002FA')}\n\nInitial Context:\n{alert_data.get('description', 'See SIEM for details.')}\n\nIOCs:\n{json.dumps(alert_data.get('iocs', {}), indent=2)}\n\"\"\"\n\n    def _get_assignment_group(self, severity):\n        if severity in (\"critical\", \"high\"):\n            return \"SOC Tier 2\"\n        return \"SOC Tier 1\"\n\n    def update_incident(self, ticket_number, updates):\n        \"\"\"Update an existing incident\"\"\"\n        # First get sys_id from ticket number\n        response = requests.get(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\",\n            auth=self.auth,\n            headers=self.headers,\n            params={\"sysparm_query\": f\"number={ticket_number}\", \"sysparm_limit\": 1}\n        )\n        sys_id = response.json()[\"result\"][0][\"sys_id\"]\n\n        # Update\n        response = requests.patch(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\u002F{sys_id}\",\n            auth=self.auth,\n            headers=self.headers,\n            json=updates\n        )\n        return response.json()[\"result\"]\n\n    def add_work_note(self, ticket_number, note):\n        \"\"\"Add investigation note to incident\"\"\"\n        self.update_incident(ticket_number, {\"work_notes\": note})\n\n    def escalate_incident(self, ticket_number, reason):\n        \"\"\"Escalate to next tier\"\"\"\n        self.update_incident(ticket_number, {\n            \"assignment_group\": \"SOC Tier 3\",\n            \"urgency\": \"1\",\n            \"work_notes\": f\"ESCALATED: {reason}\"\n        })\n\n    def resolve_incident(self, ticket_number, resolution):\n        \"\"\"Resolve and close incident\"\"\"\n        self.update_incident(ticket_number, {\n            \"state\": \"6\",  # Resolved\n            \"close_code\": \"Resolved\",\n            \"close_notes\": resolution,\n            \"u_incident_disposition\": resolution.split(\":\")[0] if \":\" in resolution else \"Resolved\"\n        })\n```\n\n### Step 3: Configure TheHive for Security-Focused Ticketing\n\n**TheHive Case Creation (alternative to ServiceNow):**\n\n```python\nimport requests\n\nclass TheHiveCaseManager:\n    def __init__(self, thehive_url, api_key):\n        self.url = thehive_url\n        self.headers = {\n            \"Authorization\": f\"Bearer {api_key}\",\n            \"Content-Type\": \"application\u002Fjson\"\n        }\n\n    def create_case(self, alert_data):\n        \"\"\"Create case in TheHive from SIEM alert\"\"\"\n        case = {\n            \"title\": f\"[{alert_data['severity'].upper()}] {alert_data['rule_name']}\",\n            \"description\": self._build_markdown_description(alert_data),\n            \"severity\": {\"critical\": 4, \"high\": 3, \"medium\": 2, \"low\": 1}.get(\n                alert_data[\"severity\"], 2\n            ),\n            \"tlp\": 2,  # TLP:AMBER\n            \"pap\": 2,  # PAP:AMBER\n            \"tags\": [\n                alert_data.get(\"mitre_technique\", \"\"),\n                alert_data.get(\"category\", \"\"),\n                f\"source:{alert_data.get('src', 'unknown')}\"\n            ],\n            \"tasks\": self._generate_tasks(alert_data[\"severity\"]),\n            \"customFields\": {\n                \"siem-event-id\": {\"string\": alert_data.get(\"notable_id\", \"\")},\n                \"mitre-technique\": {\"string\": alert_data.get(\"mitre_technique\", \"\")},\n                \"detection-source\": {\"string\": \"Splunk ES\"}\n            }\n        }\n\n        response = requests.post(\n            f\"{self.url}\u002Fapi\u002Fcase\",\n            headers=self.headers,\n            json=case\n        )\n        return response.json()\n\n    def _generate_tasks(self, severity):\n        \"\"\"Generate investigation tasks based on severity\"\"\"\n        tasks = [\n            {\"title\": \"Initial Triage\", \"group\": \"Phase 1\", \"description\": \"Review SIEM alert and validate findings\"},\n            {\"title\": \"IOC Enrichment\", \"group\": \"Phase 1\", \"description\": \"Enrich all IOCs with VT, AbuseIPDB\"},\n            {\"title\": \"Scope Assessment\", \"group\": \"Phase 2\", \"description\": \"Determine affected systems and users\"},\n        ]\n        if severity in (\"critical\", \"high\"):\n            tasks.extend([\n                {\"title\": \"Containment Actions\", \"group\": \"Phase 2\", \"description\": \"Isolate affected systems\"},\n                {\"title\": \"Evidence Collection\", \"group\": \"Phase 3\", \"description\": \"Preserve forensic artifacts\"},\n                {\"title\": \"Eradication\", \"group\": \"Phase 3\", \"description\": \"Remove threat from environment\"},\n                {\"title\": \"Recovery\", \"group\": \"Phase 4\", \"description\": \"Restore systems to normal operations\"},\n                {\"title\": \"Post-Incident Review\", \"group\": \"Phase 4\", \"description\": \"Document lessons learned\"},\n            ])\n        else:\n            tasks.append(\n                {\"title\": \"Resolution and Documentation\", \"group\": \"Phase 2\", \"description\": \"Document findings and close\"}\n            )\n        return tasks\n\n    def add_observable(self, case_id, ioc_type, ioc_value, description=\"\"):\n        \"\"\"Add IOC observable to case\"\"\"\n        observable = {\n            \"dataType\": ioc_type,\n            \"data\": ioc_value,\n            \"message\": description,\n            \"tlp\": 2,\n            \"ioc\": True,\n            \"tags\": [\"auto-extracted\"]\n        }\n        response = requests.post(\n            f\"{self.url}\u002Fapi\u002Fcase\u002F{case_id}\u002Fartifact\",\n            headers=self.headers,\n            json=observable\n        )\n        return response.json()\n```\n\n### Step 4: Implement SLA Tracking and Escalation\n\n**Splunk SLA Monitoring Dashboard:**\n```spl\n--- Active incidents approaching SLA breach\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\" state IN (\"New\", \"In Progress\")\n| eval sla_minutes = case(\n    urgency=\"1\", 15,\n    urgency=\"2\", 30,\n    urgency=\"3\", 120,\n    urgency=\"4\", 480\n  )\n| eval age_minutes = round((now() - strptime(opened_at, \"%Y-%m-%d %H:%M:%S\")) \u002F 60, 0)\n| eval sla_remaining = sla_minutes - age_minutes\n| eval sla_status = case(\n    sla_remaining \u003C 0, \"BREACHED\",\n    sla_remaining \u003C sla_minutes * 0.25, \"AT RISK\",\n    1=1, \"ON TRACK\"\n  )\n| where sla_status IN (\"BREACHED\", \"AT RISK\")\n| sort sla_remaining\n| table number, short_description, urgency, assignment_group, assigned_to,\n        age_minutes, sla_minutes, sla_remaining, sla_status\n```\n\n**Auto-Escalation Logic:**\n```python\ndef check_sla_breaches(ticket_manager):\n    \"\"\"Check for SLA breaches and auto-escalate\"\"\"\n    open_incidents = ticket_manager.get_open_incidents()\n\n    for incident in open_incidents:\n        age_minutes = (datetime.utcnow() - incident[\"opened_at\"]).total_seconds() \u002F 60\n        sla_minutes = {\"1\": 15, \"2\": 30, \"3\": 120, \"4\": 480}[incident[\"urgency\"]]\n\n        if age_minutes > sla_minutes and incident[\"state\"] == \"New\":\n            ticket_manager.escalate_incident(\n                incident[\"number\"],\n                f\"SLA BREACH: {int(age_minutes)}min elapsed, {sla_minutes}min SLA. Auto-escalating.\"\n            )\n```\n\n### Step 5: Build Reporting and Metrics\n\n```spl\n--- Monthly incident metrics\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\"\nopened_at > \"2024-03-01\" opened_at \u003C \"2024-04-01\"\n| stats count AS total,\n        avg(eval((resolved_at - opened_at) \u002F 3600)) AS avg_resolution_hours,\n        sum(eval(if(urgency=\"1\", 1, 0))) AS critical,\n        sum(eval(if(urgency=\"2\", 1, 0))) AS high,\n        sum(eval(if(urgency=\"3\", 1, 0))) AS medium,\n        sum(eval(if(urgency=\"4\", 1, 0))) AS low\n| eval avg_resolution = round(avg_resolution_hours, 1)\n\n--- SLA compliance rate\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\" state=\"Resolved\"\n| eval sla_target = case(urgency=\"1\", 4, urgency=\"2\", 8, urgency=\"3\", 24, urgency=\"4\", 72)\n| eval resolution_hours = (resolved_at - opened_at) \u002F 3600\n| eval sla_met = if(resolution_hours \u003C= sla_target, 1, 0)\n| stats sum(sla_met) AS met, count AS total\n| eval compliance_pct = round(met \u002F total * 100, 1)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Incident Ticket** | Formal tracking record for a confirmed security incident with lifecycle management |\n| **SLA** | Service Level Agreement defining maximum response and resolution times by severity |\n| **Escalation Path** | Defined routing from Tier 1 to Tier 2\u002F3 based on severity, time elapsed, or analyst request |\n| **Disposition** | Final classification of a closed incident (true positive, false positive, duplicate, policy violation) |\n| **MTTR** | Mean Time to Resolve — average time from ticket creation to resolution across all incidents |\n| **Case Management** | Structured approach to managing complex incidents with tasks, observables, and audit trails |\n\n## Tools & Systems\n\n- **ServiceNow ITSM**: Enterprise IT service management platform with security incident module and SLA tracking\n- **Jira Service Management**: Atlassian's service management platform with customizable incident workflows\n- **TheHive**: Open-source security incident response platform with case management and Cortex integration\n- **PagerDuty**: On-call management and incident notification platform for SOC analyst alerting\n- **Splunk ITSI**: IT Service Intelligence module for SLA tracking and service health dashboards\n\n## Common Scenarios\n\n- **SIEM-to-Ticket Automation**: Auto-create ServiceNow ticket for every critical\u002Fhigh notable event in Splunk ES\n- **Multi-Team Coordination**: Route malware incidents to SOC for triage, IT for remediation, Legal for notification\n- **Compliance Documentation**: Generate incident reports from ticket data for PCI DSS, HIPAA audit evidence\n- **On-Call Alerting**: Page on-call analyst via PagerDuty when critical ticket created after hours\n- **Post-Incident Review**: Query closed tickets to identify recurring incident types and systemic gaps\n\n## Output Format\n\n```\nINCIDENT TICKET — INC0012567\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nTitle:        [SEC] Cobalt Strike C2 Beacon Detected — WORKSTATION-042\nCategory:     Security > Malware Infection\nSeverity:     Critical (P1)\nSLA:          Response: 15 min | Resolution: 4 hours\n\nTimeline:\n  14:23  Ticket created (auto from Splunk ES NE-2024-08921)\n  14:25  Assigned to analyst_jdoe (Tier 2)\n  14:28  Work note: \"VT confirms Cobalt Strike beacon, hash a1b2c3...\"\n  14:35  Work note: \"Host isolated via CrowdStrike, C2 domain blocked\"\n  15:00  Work note: \"Enterprise IOC scan — 2 additional hosts found\"\n  15:30  Escalated to Tier 3 for forensic analysis\n  16:00  Work note: \"All affected hosts contained and cleaned\"\n  18:00  Resolved: \"Malware eradicated, systems restored, monitoring for 72h\"\n\nMetrics:\n  Time to Acknowledge: 2 minutes\n  Time to Contain:     12 minutes\n  Time to Resolve:     3 hours 37 minutes\n  SLA Status:          MET (within 4-hour resolution target)\n```\n","# Implementing Ticketing System for Incidents\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to formalize incident tracking beyond SIEM notable event management\n- Compliance requirements mandate documented incident lifecycle with timestamps and audit trails\n- Multi-team coordination requires ticket-based workflows with assignment and escalation\n- SLA tracking needs automated measurement of response and resolution times\n- Post-incident reviews require structured data for trend analysis and reporting\n\n**Do not use** for individual alert triage — ticketing is for confirmed incidents requiring multi-step investigation and remediation, not every SIEM alert.\n\n## Prerequisites\n\n- Ticketing platform: ServiceNow ITSM, Jira Service Management, or TheHive\n- SIEM integration capability (REST API, webhook, or SOAR connector)\n- Incident classification taxonomy (categories, severity levels, escalation paths)\n- On-call rotation schedule for analyst assignment\n- SLA definitions aligned to incident severity\n\n## Workflow\n\n### Step 1: Define Incident Classification Taxonomy\n\nEstablish standardized incident categories and severity:\n\n```yaml\nincident_taxonomy:\n  categories:\n    - malware_infection\n    - phishing_campaign\n    - unauthorized_access\n    - data_exfiltration\n    - denial_of_service\n    - ransomware\n    - insider_threat\n    - vulnerability_exploitation\n    - account_compromise\n    - policy_violation\n\n  severity_levels:\n    critical:\n      definition: \"Active data breach, ransomware, or business-critical system compromise\"\n      response_sla: 15 minutes\n      resolution_sla: 4 hours\n      escalation: immediate to Tier 3 + CISO notification\n      examples: [\"Active ransomware\", \"Domain admin compromise\", \"Customer data breach\"]\n\n    high:\n      definition: \"Confirmed compromise of business systems or multiple user accounts\"\n      response_sla: 30 minutes\n      resolution_sla: 8 hours\n      escalation: Tier 2 immediate, Tier 3 if unresolved in 2 hours\n      examples: [\"Malware with C2\", \"Lateral movement detected\", \"Phishing with credential theft\"]\n\n    medium:\n      definition: \"Confirmed security event requiring investigation and remediation\"\n      response_sla: 2 hours\n      resolution_sla: 24 hours\n      escalation: Tier 2 within 4 hours\n      examples: [\"Single phishing click\", \"Unauthorized software\", \"Policy violation\"]\n\n    low:\n      definition: \"Minor security event with limited impact\"\n      response_sla: 8 hours\n      resolution_sla: 72 hours\n      escalation: Tier 1 standard queue\n      examples: [\"Scan attempt\", \"Failed brute force (no compromise)\", \"Info disclosure\"]\n```\n\n### Step 2: Automate Ticket Creation from SIEM\n\n**ServiceNow Integration via REST API:**\n\n```python\nimport requests\nimport json\nfrom datetime import datetime\n\nclass IncidentTicketManager:\n    def __init__(self, snow_url, snow_user, snow_password):\n        self.snow_url = snow_url\n        self.auth = (snow_user, snow_password)\n        self.headers = {\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\"\n        }\n\n    def create_incident(self, alert_data):\n        \"\"\"Create ServiceNow incident from SIEM alert\"\"\"\n        severity_map = {\n            \"critical\": \"1\",\n            \"high\": \"2\",\n            \"medium\": \"3\",\n            \"low\": \"4\"\n        }\n\n        payload = {\n            \"short_description\": f\"[SEC] {alert_data['rule_name']} — {alert_data['src']}\",\n            \"description\": self._build_description(alert_data),\n            \"category\": \"Security\",\n            \"subcategory\": alert_data.get(\"category\", \"Investigation\"),\n            \"urgency\": severity_map.get(alert_data[\"severity\"], \"3\"),\n            \"impact\": severity_map.get(alert_data[\"severity\"], \"3\"),\n            \"assignment_group\": self._get_assignment_group(alert_data[\"severity\"]),\n            \"caller_id\": \"soc_automation\",\n            \"u_siem_event_id\": alert_data.get(\"notable_id\", \"\"),\n            \"u_mitre_technique\": alert_data.get(\"mitre_technique\", \"\"),\n            \"u_affected_hosts\": \", \".join(alert_data.get(\"affected_hosts\", [])),\n            \"u_iocs\": json.dumps(alert_data.get(\"iocs\", {}))\n        }\n\n        response = requests.post(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\",\n            auth=self.auth,\n            headers=self.headers,\n            json=payload\n        )\n        result = response.json()[\"result\"]\n        return {\n            \"ticket_number\": result[\"number\"],\n            \"sys_id\": result[\"sys_id\"],\n            \"state\": result[\"state\"]\n        }\n\n    def _build_description(self, alert_data):\n        return f\"\"\"\nSECURITY INCIDENT — Auto-generated from SIEM\n================================================\nAlert Rule:       {alert_data['rule_name']}\nSIEM Event ID:    {alert_data.get('notable_id', 'N\u002FA')}\nDetection Time:   {alert_data['detection_time']}\nSeverity:         {alert_data['severity'].upper()}\nMITRE ATT&CK:    {alert_data.get('mitre_technique', 'N\u002FA')}\n\nSource:           {alert_data.get('src', 'N\u002FA')}\nDestination:      {alert_data.get('dest', 'N\u002FA')}\nUser:             {alert_data.get('user', 'N\u002FA')}\n\nInitial Context:\n{alert_data.get('description', 'See SIEM for details.')}\n\nIOCs:\n{json.dumps(alert_data.get('iocs', {}), indent=2)}\n\"\"\"\n\n    def _get_assignment_group(self, severity):\n        if severity in (\"critical\", \"high\"):\n            return \"SOC Tier 2\"\n        return \"SOC Tier 1\"\n\n    def update_incident(self, ticket_number, updates):\n        \"\"\"Update an existing incident\"\"\"\n        # First get sys_id from ticket number\n        response = requests.get(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\",\n            auth=self.auth,\n            headers=self.headers,\n            params={\"sysparm_query\": f\"number={ticket_number}\", \"sysparm_limit\": 1}\n        )\n        sys_id = response.json()[\"result\"][0][\"sys_id\"]\n\n        # Update\n        response = requests.patch(\n            f\"{self.snow_url}\u002Fapi\u002Fnow\u002Ftable\u002Fincident\u002F{sys_id}\",\n            auth=self.auth,\n            headers=self.headers,\n            json=updates\n        )\n        return response.json()[\"result\"]\n\n    def add_work_note(self, ticket_number, note):\n        \"\"\"Add investigation note to incident\"\"\"\n        self.update_incident(ticket_number, {\"work_notes\": note})\n\n    def escalate_incident(self, ticket_number, reason):\n        \"\"\"Escalate to next tier\"\"\"\n        self.update_incident(ticket_number, {\n            \"assignment_group\": \"SOC Tier 3\",\n            \"urgency\": \"1\",\n            \"work_notes\": f\"ESCALATED: {reason}\"\n        })\n\n    def resolve_incident(self, ticket_number, resolution):\n        \"\"\"Resolve and close incident\"\"\"\n        self.update_incident(ticket_number, {\n            \"state\": \"6\",  # Resolved\n            \"close_code\": \"Resolved\",\n            \"close_notes\": resolution,\n            \"u_incident_disposition\": resolution.split(\":\")[0] if \":\" in resolution else \"Resolved\"\n        })\n```\n\n### Step 3: Configure TheHive for Security-Focused Ticketing\n\n**TheHive Case Creation (alternative to ServiceNow):**\n\n```python\nimport requests\n\nclass TheHiveCaseManager:\n    def __init__(self, thehive_url, api_key):\n        self.url = thehive_url\n        self.headers = {\n            \"Authorization\": f\"Bearer {api_key}\",\n            \"Content-Type\": \"application\u002Fjson\"\n        }\n\n    def create_case(self, alert_data):\n        \"\"\"Create case in TheHive from SIEM alert\"\"\"\n        case = {\n            \"title\": f\"[{alert_data['severity'].upper()}] {alert_data['rule_name']}\",\n            \"description\": self._build_markdown_description(alert_data),\n            \"severity\": {\"critical\": 4, \"high\": 3, \"medium\": 2, \"low\": 1}.get(\n                alert_data[\"severity\"], 2\n            ),\n            \"tlp\": 2,  # TLP:AMBER\n            \"pap\": 2,  # PAP:AMBER\n            \"tags\": [\n                alert_data.get(\"mitre_technique\", \"\"),\n                alert_data.get(\"category\", \"\"),\n                f\"source:{alert_data.get('src', 'unknown')}\"\n            ],\n            \"tasks\": self._generate_tasks(alert_data[\"severity\"]),\n            \"customFields\": {\n                \"siem-event-id\": {\"string\": alert_data.get(\"notable_id\", \"\")},\n                \"mitre-technique\": {\"string\": alert_data.get(\"mitre_technique\", \"\")},\n                \"detection-source\": {\"string\": \"Splunk ES\"}\n            }\n        }\n\n        response = requests.post(\n            f\"{self.url}\u002Fapi\u002Fcase\",\n            headers=self.headers,\n            json=case\n        )\n        return response.json()\n\n    def _generate_tasks(self, severity):\n        \"\"\"Generate investigation tasks based on severity\"\"\"\n        tasks = [\n            {\"title\": \"Initial Triage\", \"group\": \"Phase 1\", \"description\": \"Review SIEM alert and validate findings\"},\n            {\"title\": \"IOC Enrichment\", \"group\": \"Phase 1\", \"description\": \"Enrich all IOCs with VT, AbuseIPDB\"},\n            {\"title\": \"Scope Assessment\", \"group\": \"Phase 2\", \"description\": \"Determine affected systems and users\"},\n        ]\n        if severity in (\"critical\", \"high\"):\n            tasks.extend([\n                {\"title\": \"Containment Actions\", \"group\": \"Phase 2\", \"description\": \"Isolate affected systems\"},\n                {\"title\": \"Evidence Collection\", \"group\": \"Phase 3\", \"description\": \"Preserve forensic artifacts\"},\n                {\"title\": \"Eradication\", \"group\": \"Phase 3\", \"description\": \"Remove threat from environment\"},\n                {\"title\": \"Recovery\", \"group\": \"Phase 4\", \"description\": \"Restore systems to normal operations\"},\n                {\"title\": \"Post-Incident Review\", \"group\": \"Phase 4\", \"description\": \"Document lessons learned\"},\n            ])\n        else:\n            tasks.append(\n                {\"title\": \"Resolution and Documentation\", \"group\": \"Phase 2\", \"description\": \"Document findings and close\"}\n            )\n        return tasks\n\n    def add_observable(self, case_id, ioc_type, ioc_value, description=\"\"):\n        \"\"\"Add IOC observable to case\"\"\"\n        observable = {\n            \"dataType\": ioc_type,\n            \"data\": ioc_value,\n            \"message\": description,\n            \"tlp\": 2,\n            \"ioc\": True,\n            \"tags\": [\"auto-extracted\"]\n        }\n        response = requests.post(\n            f\"{self.url}\u002Fapi\u002Fcase\u002F{case_id}\u002Fartifact\",\n            headers=self.headers,\n            json=observable\n        )\n        return response.json()\n```\n\n### Step 4: Implement SLA Tracking and Escalation\n\n**Splunk SLA Monitoring Dashboard:**\n```spl\n--- Active incidents approaching SLA breach\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\" state IN (\"New\", \"In Progress\")\n| eval sla_minutes = case(\n    urgency=\"1\", 15,\n    urgency=\"2\", 30,\n    urgency=\"3\", 120,\n    urgency=\"4\", 480\n  )\n| eval age_minutes = round((now() - strptime(opened_at, \"%Y-%m-%d %H:%M:%S\")) \u002F 60, 0)\n| eval sla_remaining = sla_minutes - age_minutes\n| eval sla_status = case(\n    sla_remaining \u003C 0, \"BREACHED\",\n    sla_remaining \u003C sla_minutes * 0.25, \"AT RISK\",\n    1=1, \"ON TRACK\"\n  )\n| where sla_status IN (\"BREACHED\", \"AT RISK\")\n| sort sla_remaining\n| table number, short_description, urgency, assignment_group, assigned_to,\n        age_minutes, sla_minutes, sla_remaining, sla_status\n```\n\n**Auto-Escalation Logic:**\n```python\ndef check_sla_breaches(ticket_manager):\n    \"\"\"Check for SLA breaches and auto-escalate\"\"\"\n    open_incidents = ticket_manager.get_open_incidents()\n\n    for incident in open_incidents:\n        age_minutes = (datetime.utcnow() - incident[\"opened_at\"]).total_seconds() \u002F 60\n        sla_minutes = {\"1\": 15, \"2\": 30, \"3\": 120, \"4\": 480}[incident[\"urgency\"]]\n\n        if age_minutes > sla_minutes and incident[\"state\"] == \"New\":\n            ticket_manager.escalate_incident(\n                incident[\"number\"],\n                f\"SLA BREACH: {int(age_minutes)}min elapsed, {sla_minutes}min SLA. Auto-escalating.\"\n            )\n```\n\n### Step 5: Build Reporting and Metrics\n\n```spl\n--- Monthly incident metrics\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\"\nopened_at > \"2024-03-01\" opened_at \u003C \"2024-04-01\"\n| stats count AS total,\n        avg(eval((resolved_at - opened_at) \u002F 3600)) AS avg_resolution_hours,\n        sum(eval(if(urgency=\"1\", 1, 0))) AS critical,\n        sum(eval(if(urgency=\"2\", 1, 0))) AS high,\n        sum(eval(if(urgency=\"3\", 1, 0))) AS medium,\n        sum(eval(if(urgency=\"4\", 1, 0))) AS low\n| eval avg_resolution = round(avg_resolution_hours, 1)\n\n--- SLA compliance rate\nindex=servicenow sourcetype=\"snow:incident\" category=\"Security\" state=\"Resolved\"\n| eval sla_target = case(urgency=\"1\", 4, urgency=\"2\", 8, urgency=\"3\", 24, urgency=\"4\", 72)\n| eval resolution_hours = (resolved_at - opened_at) \u002F 3600\n| eval sla_met = if(resolution_hours \u003C= sla_target, 1, 0)\n| stats sum(sla_met) AS met, count AS total\n| eval compliance_pct = round(met \u002F total * 100, 1)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Incident Ticket** | Formal tracking record for a confirmed security incident with lifecycle management |\n| **SLA** | Service Level Agreement defining maximum response and resolution times by severity |\n| **Escalation Path** | Defined routing from Tier 1 to Tier 2\u002F3 based on severity, time elapsed, or analyst request |\n| **Disposition** | Final classification of a closed incident (true positive, false positive, duplicate, policy violation) |\n| **MTTR** | Mean Time to Resolve — average time from ticket creation to resolution across all incidents |\n| **Case Management** | Structured approach to managing complex incidents with tasks, observables, and audit trails |\n\n## Tools & Systems\n\n- **ServiceNow ITSM**: Enterprise IT service management platform with security incident module and SLA tracking\n- **Jira Service Management**: Atlassian's service management platform with customizable incident workflows\n- **TheHive**: Open-source security incident response platform with case management and Cortex integration\n- **PagerDuty**: On-call management and incident notification platform for SOC analyst alerting\n- **Splunk ITSI**: IT Service Intelligence module for SLA tracking and service health dashboards\n\n## Common Scenarios\n\n- **SIEM-to-Ticket Automation**: Auto-create ServiceNow ticket for every critical\u002Fhigh notable event in Splunk ES\n- **Multi-Team Coordination**: Route malware incidents to SOC for triage, IT for remediation, Legal for notification\n- **Compliance Documentation**: Generate incident reports from ticket data for PCI DSS, HIPAA audit evidence\n- **On-Call Alerting**: Page on-call analyst via PagerDuty when critical ticket created after hours\n- **Post-Incident Review**: Query closed tickets to identify recurring incident types and systemic gaps\n\n## Output Format\n\n```\nINCIDENT TICKET — INC0012567\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nTitle:        [SEC] Cobalt Strike C2 Beacon Detected — WORKSTATION-042\nCategory:     Security > Malware Infection\nSeverity:     Critical (P1)\nSLA:          Response: 15 min | Resolution: 4 hours\n\nTimeline:\n  14:23  Ticket created (auto from Splunk ES NE-2024-08921)\n  14:25  Assigned to analyst_jdoe (Tier 2)\n  14:28  Work note: \"VT confirms Cobalt Strike beacon, hash a1b2c3...\"\n  14:35  Work note: \"Host isolated via CrowdStrike, C2 domain blocked\"\n  15:00  Work note: \"Enterprise IOC scan — 2 additional hosts found\"\n  15:30  Escalated to Tier 3 for forensic analysis\n  16:00  Work note: \"All affected hosts contained and cleaned\"\n  18:00  Resolved: \"Malware eradicated, systems restored, monitoring for 72h\"\n\nMetrics:\n  Time to Acknowledge: 2 minutes\n  Time to Contain:     12 minutes\n  Time to Resolve:     3 hours 37 minutes\n  SLA Status:          MET (within 4-hour resolution target)\n```\n",{"name":5,"tags":49,"author":52,"domain":35,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":60,"mitre_attack":61},[38,26,27,39,34,50,51,42],"incident-management","sla","mahipal","1.0",[55,56,57,58],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.\n",[62,63,64,65],"T1078","T1685.002","T1685.005","T1566","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-ticketing-system-for-incidents",{"tool":80,"command":81},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-ticketing-system-for-incidents",{"tool":83,"command":84},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-ticketing-system-for-incidents","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents\u002FSKILL.md",true,[88,93,99],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2413,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",10045,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ticketing-system-for-incidents\u002Fscripts\u002Fagent.py",[106,147,156,165,187,213],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":127,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[113,116,119,122],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[108,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":148,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":155,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[151,152,153,154],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},[108,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],{"skillNo":157,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[160,161,162,163],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},[108,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[172,173,174,175,176,177,178,179,180,181,182,183,184,185,186],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,198,199,200,201,202,203,204,205,139,140,206,207,208,209,210,211,212],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":229,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[219,222,225,226],{"categoryNo":220,"categoryName":221,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":223,"categoryName":224,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":227,"categoryName":228,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000036","内容创作者",[230,231,232,233,234,235,236,237,136,238,139,140,141,239,240,241,242,243,186,244],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]