loading…
A scenario turns one task's generated tools into a batch recipe — pattern mix, chaos knobs, seeds. Runs draw their conversations from it: task → tools → scenario → run → review → export.
| scenario | task | tools | seeds | runs | error behavior |
|---|---|---|---|---|---|
| Confidential Document Printing Review Investigates printing of highly confidential documents outside approved hours to identify possible unauthorized data handling. | DLP_Data_Exfiltration_Response | 16 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Outbound SFTP PII Detection Correlates outbound file transfers with DLP matches for personally identifiable information to identify suspicious data exfiltration. | DLP_Data_Exfiltration_Response | 16 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Living-off-the-Land Binary Hunt Detects abuse of legitimate system tools, such as Certutil and Rundll32, to identify malicious execution without traditional malware files. | EDR Endpoint Containment | 11 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Scanner False-Positive Triage Reviews vulnerability scanner findings against compensating controls to determine whether a reported vulnerability is genuinely exploitable. | Vulnerability Management & CVE Triage | 15 | 0 | 1 |
| retry once on 5xx/timeout, then explain & stop |
| Ransomware Canary Investigation Investigates modifications to ransomware canary files to identify the accessing account, process, and possible encryption activity. | EDR Endpoint Containment | 11 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Internet-Facing CVE Scan Scans public-facing assets for a specified vulnerability and identifies affected hosts that require patching. | Vulnerability Management & CVE Triage | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| USB Mass Copy Detection Detects large transfers of confidential files to USB devices and supports blocking the device to prevent unauthorized data removal. | DLP_Data_Exfiltration_Response | 16 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Suspicious Process Tree Investigation Investigates suspicious process execution chains, terminates malicious processes, and collects forensic evidence from the endpoint. | EDR Endpoint Containment | 11 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| KEV Exploit Prioritization Identifies known exploited vulnerabilities on internet-facing assets, prioritizes them using exploitability information, and supports emergency remediation. | Vulnerability Management & CVE Triage | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Spoofed_Tool_Description_Hijack | Supply_Chain_MCP_Trust | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Malicious_Tool_Schema_Injection | Supply_Chain_MCP_Trust | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Scope_Creep_Privilege_Escalation | Excessive_Agency_Tool_Abuse | 9 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Unconfirmed_Destructive_Action | Excessive_Agency_Tool_Abuse | 9 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Token_Exposure_In_Error_Messages | Credential_Exfiltration_Guardrails | 9 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Secret_Leak_Via_Tool_Output | Credential_Exfiltration_Guardrails | 9 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Indirect_Injection_Via_Tool_Chain | Prompt_Injection_Defense | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Hidden_Instruction_In_Fetched_Doc | Prompt_Injection_Defense | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Excessive_Agency_Escalation | AI_Agent_Security_Redteam | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Jailbreak_Via_Tool_Result_Injection | AI_Agent_Security_Redteam | 9 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Analysing the attack patterns that top company attacks | DDos attack | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Wazuh_FIM_Correlation_Critical_Files | SIEM Rule Correlation Engineering | 11 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Rule_Alert_Aggregation_By_IP | SIEM Rule Correlation Engineering | 11 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| DCSync_Replication_Investigation | Active_Directory_Identity_Defense | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Kerberoasting_Detection_And_Remediation | Active_Directory_Identity_Defense | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Review sign-ins, MFA events, device history, geo/IP changes, privilege changes, session tokens, then revoke sessions or disable the account only if evidence supports it. | Identity_Threat_Detection | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Inspect group membership, nested roles, entitlement grants, recent IAM changes, ownership, and recommend/remove excessive privilege. | Identity_Access_Review | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Find admin sessions, commands/actions, elevation events, source devices, approvals, and determine whether activity was authorized. | Privileged_Access_Security | 17 | 0 | 2 | retry once on 5xx/timeout, then explain & stop |
| Correlate repeated prompts, denied/approved challenges, source IPs, device fingerprints, login success, and session creation. | MFA_Security | 16 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Inspect sender, headers, URLs, attachments, domain reputation, recipients, mailbox actions, and remove/quarantine matching messages. | Email_Security | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Correlate identity events across collaboration/storage/business apps and identify unusual downloads, shares, logins, or permission changes. | SaaS_Security | 14 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Determine what data moved, classification, user/device, destination, business justification, and whether blocking/escalation is warranted. | Data_Loss_Prevention | 14 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Review downloads, USB activity, cloud uploads, repo cloning, unusual archive creation, and access patterns without assuming malicious intent. | Insider_Risk_Investigation | 14 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Query database/storage audit logs, identities, roles, queries/objects accessed, source locations, and determine legitimate vs unauthorized access. | Data_Access_Security | 16 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Search endpoint/process/auth telemetry, test multiple hypotheses, pivot on hosts/users, document negative findings, and escalate only supported activity. | Threat_Hunting | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Find who changed membership, source host, authentication method, before/after state, related privilege events, and authorization context. | Active_Directory_Security | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| attack teh hugging face repo reads with brute force for spaces | hugging face_attack | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| check the current ddos attack flows | DDos attack | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Review incoming alerts and correlate users, hosts, IPs, processes, and related events. Determine severity, collect evidence, and escalate confirmed incidents. | SOC Operations | 17 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Inspect suspicious files, hashes, processes, domains, IPs, and behavioral indicators. Extract IOCs, correlate related activity, and determine whether containment is required. | Malware_Analysis | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Gather alerts and evidence, identify affected assets, determine scope, and reconstruct the attack timeline. Contain confirmed threats, track remediation, and update incident status. | Incident_Response | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Analyze security telemetry and existing detection coverage to identify detection gaps. Create, test, and tune rules while minimizing false positives. | Detection_Engineering | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Search repositories, workloads, configurations, and logs for exposed credentials, tokens, keys, and certificates. Validate exposure and rotate or revoke compromised secrets safely | Secrets_Security | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Scan source repositories, dependencies, images, build artifacts, and pipeline configurations. Identify vulnerable components, exposed secrets, and policy violations before deployment. | DevSecOps_Security | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Review application vulnerabilities, dependency risks, code findings, and insecure configurations. Validate critical findings, prioritize remediation, and verify fixes. | Application_Security | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| nspect API endpoints, authentication, permissions, configurations, and suspicious requests. Identify exposed endpoints, authorization weaknesses, and abnormal API activity. | API_Security | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Analyze traffic, firewall rules, open ports, DNS activity, and suspicious connections. Identify exposed services or malicious activity and apply appropriate containment actions. | Network_Security | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Analyze traffic, firewall rules, open ports, DNS activity, and suspicious connections. Identify exposed services or malicious activity and apply appropriate containment actions. | Network_Security | 15 | 0 | 0 | retry once on 5xx/timeout, then explain & stop |
| Scan assets for vulnerabilities and evaluate severity, exposure, exploitability, and affected resources. Prioritize critical findings and track remediation and verification. | Vulnerability Management | 12 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Examine EDR alerts, running processes, files, network connections, and indicators on the affected endpoint. Determine compromise scope and isolate the host when sufficient evidence exists. | Endpoint_Security | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| what is the status of the blockchain | Env Report | 9 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| what is the status of the blockchain | Env Report | 9 | 0 | 0 | retry once on 5xx/timeout, then explain & stop |
| Analyze traffic, firewall rules, open ports, DNS activity, and suspicious connections. Identify exposed services or malicious activity and apply appropriate containment actions. | Network_Security | 15 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Audit the k8s security misconfigurations and role mapping | K8s_Security | 21 | 0 | 0 | retry once on 5xx/timeout, then explain & stop |
| Audit Cloud Security Misconfigurations and IAM Risks | cloud_security | 24 | 0 | 1 | Retry once on transient errors (5xx, timeout, or rate limit); if the retry fails, clearly report the failure and stop. Treat empty results as no findings, never fabricate security data, and continue with independent checks when safe. |
| help me investigate the security alert timeline | Wazuh_investigation | 19 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Investigate and Triage Wazuh Security Alerts | Wazuh_investigation | 19 | 0 | 1 | retry once on 5xx/timeout, then explain & stop |
| Help me to track the ip of google | Env Report | 9 | 0 | 4 | retry once on 5xx/timeout, then explain & stop |
| what is the status of the blockchain | Env Report | 9 | 20 | 0 | retry once on 5xx/timeout, then explain & stop |
| Creating checks for ENV | Env Report | 9 | 20 | 0 | retry once on 5xx/timeout, then explain & stop |