asp-case-investigation

asp-case-investigation is a case-centered investigation workflow skill. Use it for triage, evidence review, context enrichment, and next-step recommendations.

Invocation

/asp-case-investigation

It combines capabilities such as asp-case, asp-alert, asp-artifact, asp-siem-search, asp-knowledge, asp-enrichment, and asp-comment.

Common Examples

/asp-case-investigation investigate case_000001 and provide severity, confidence, and next steps

/asp-case-investigation review alerts and artifacts in case_000001 and decide whether it is a false positive

/asp-case-investigation identify which evidence is still missing for case_000001

Common CLI commands:

asp case show case_000001 --include-related --output json
asp alert list --case-id case_000001 --output json
asp playbook list --case-id case_000001 --output json

The initial Case view includes direct Case relationship summaries. The Skill treats them as investigation leads rather than malicious evidence. It queries another Case only when that Case can affect the current judgment and does not recursively traverse the full relationship graph.

See Related Cases in the Case workspace for details.