Skill

orca-investigate

CDR-powered incident investigation — traces actor activity, builds session timelines, maps MITRE ATT&CK techniques, and assesses blast radius from cloud audit logs. Use when user asks to investigate activity, trace an actor, or analyze an incident (e.g., "investigate bastion-admin", "trace activity"

Claim this listing

Connect your GitHub to prove you own or maintain this listing. We verify repo access automatically — most publishers are confirmed in seconds.

1Connect GitHub

2Submit your claim

3Auto-verified, or reviewed within 48h