sysdig-runtime-investigate
Use this skill when investigating a runtime threat detected by Sysdig end-to-end. Surfaces the highest-priority threat, scores vulnerability vs runtime correlations on a 1-5 confidence scale, deep-dives into network blast radius or suspicious-binary VirusTotal lookups depending on the event class, reconstructs the affected workload's activity audit trail (commands, connections, file accesses) as a timeline around the detection, and hands the case off to Jira or PagerDuty. Triggers on: "investigate runtime threat", "what is this Falco alert", "triage this SOC alert", "analyze runtime incident". Not for vulnerability prioritization (use sysdig-investigate) or remediation (use sysdig-remediate).
Pinned to revision 03cadb82f5a2, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- Read
- Write
- Glob
- Grep
- AskUserQuestion
- WebFetch
- Bash(env*)
- Bash(curl *ipinfo.io*)
- Bash(curl *ip-api.com*)
- Bash(curl *virustotal.com*)
- Bash(curl *events.pagerduty.com*)
- mcp__secure-mcp-server__get_skill_state
- mcp__secure-mcp-server__save_skill_state
- mcp__secure-mcp-server__delete_skill_state
- mcp__secure-mcp-server__list_runtime_events
- mcp__secure-mcp-server__count_runtime_events
- mcp__secure-mcp-server__discover_runtime_event_field_values
- mcp__secure-mcp-server__get_event_info
- mcp__secure-mcp-server__get_event_process_tree
- mcp__secure-mcp-server__list_activity_audit_events
- mcp__secure-mcp-server__get_activity_audit_event
- mcp__secure-mcp-server__trace_activity_audit_command
- mcp__secure-mcp-server__list_threats_engine_threats
- mcp__secure-mcp-server__get_threats_engine_threat
- mcp__secure-mcp-server__list_threats_engine_occurrences_by_threat
- mcp__secure-mcp-server__get_threats_engine_occurrence
- mcp__secure-mcp-server__list_threats_engine_resources_by_threat
- mcp__secure-mcp-server__list_threats_engine_rules_by_threat
- mcp__secure-mcp-server__run_sysql
- mcp__secure-mcp-server__query_vulnerability_findings
- mcp__secure-mcp-server__list_runtime_scan_results
- mcp__secure-mcp-server__get_scan_result
- mcp__secure-mcp-server__fetch_threat_intelligence_feed
- mcp__secure-mcp-server__get_brand_kit
- mcp__secure-mcp-server__get_design_tokens
Files
- skills/sysdig-runtime-investigate/SKILL.md
- skills/sysdig-runtime-investigate/agents/openai.yaml
- skills/sysdig-runtime-investigate/references/activity-audit.md
- skills/sysdig-runtime-investigate/references/agent-capabilities.md
- skills/sysdig-runtime-investigate/references/auth-preflight.md
- skills/sysdig-runtime-investigate/references/correlation-guide.md
- skills/sysdig-runtime-investigate/references/enrichment-binary.md
- skills/sysdig-runtime-investigate/references/enrichment-network.md
- skills/sysdig-runtime-investigate/references/first-run-notice.md
- skills/sysdig-runtime-investigate/references/mcp-setup.md
- skills/sysdig-runtime-investigate/references/mitre-tactics.md
- skills/sysdig-runtime-investigate/references/on-brand-output.md
- skills/sysdig-runtime-investigate/references/reporting-templates.md
- skills/sysdig-runtime-investigate/references/sysdig-brand.md
- skills/sysdig-runtime-investigate/references/trust-preamble.md
- skills/sysdig-runtime-investigate/references/watchlist-patterns.md
Every link opens the file at its source, pinned to the revision this page describes.