version: "1.0.0"

bb-edr: Triage Skill

Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan.

Inputs

• .hush/audit.jsonl (JSONL) — clawdstrike audit events (allowed/denied, guard, reason).
• policy.yaml — the active security policy.

Task

1. Read and summarize the last ~50 audit events.
2. Focus on denied events first:

• Group by guard (e.g., forbidden_path, egress, patch_integrity)
• Identify likely intent (misconfiguration vs. suspicious)

1. Produce a short incident report:

• What happened (timeline + key indicators)
• Impact assessment (what was attempted, what was blocked)
• Recommended response (least-privilege)

1. If you propose any response action (writing files, changing config), use `policy_check` first and keep changes scoped to this project directory.

Output

• Write ./reports/incident.md containing the final report.

Notes (important)

• clawdstrike enforces at the tool boundary. It is not an OS sandbox.
• If an operation is denied, treat it as a strong indicator of suspicious behavior or incorrect policy assumptions.