How do I install the Triage Suspicious Login skill?

Run npx skillmds@latest add majiayu000/triage-suspicious-login in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Triage Suspicious Login safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Triage Suspicious Login?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Triage Suspicious Login free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Triage Suspicious Login?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Triage Suspicious Login by majiayu000

Name: Triage Suspicious Login
Rating: 4.5 (4 reviews)
Author: majiayu000

Triage Suspicious Login

Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.

majiayu000 Updated Sep 9, 2026 567 repo stars

File contents

Suspicious Login Triage Skill

Guide initial triage of suspicious login alerts (impossible travel, untrusted location, multiple failed logins) for Tier 1 SOC Analysts.

Inputs

CASE_ID - SOAR case ID containing the alert(s)
ALERT_GROUP_IDENTIFIERS - Alert group identifiers from the case
(Optional) USER_ID - The user ID if known upfront
(Optional) SOURCE_IP - The source IP if known upfront

Workflow

Step 1: Get Case Context

secops-soar.get_case_full_details(case_id=CASE_ID)

Step 2: Extract Key Entities

secops-soar.list_events_by_alert(case_id=CASE_ID, alert_id=ALERT_ID)

Parse events to extract:

USER_ID - The user account
SOURCE_IP - The login source IP
HOSTNAME - The target/source hostname (if available)

Step 3: User Context (SIEM)

secops-mcp.lookup_entity(entity_value=USER_ID)

Record: Recent activity, first/last seen, related alerts.

Step 4: Source IP Enrichment

Use /enrich-ioc with IOC_TYPE="IP Address":

GTI reputation and geolocation
SIEM entity summary
IOC match status

Step 5: Hostname Context (if available)

secops-mcp.lookup_entity(entity_value=HOSTNAME)

Step 6: Recent Login Activity

Search for login patterns over the last 96 hours:

secops-mcp.search_security_events(
    text='metadata.event_type IN ("USER_LOGIN", "AUTH_ATTEMPT") AND principal.user.userid = "USER_ID"',
    hours_back=96
)

Analyze for:

Logins from unusual IPs
Successful logins after failures
Geographic anomalies (impossible travel)
Concurrent sessions from different locations

Step 7: Check Related Cases

Use /find-relevant-case with search terms: [USER_ID, SOURCE_IP, HOSTNAME]

Step 8: (Optional) Identity Provider Check

If IDP tools available (e.g., Okta):

Account status
MFA enrollment
Recent legitimate logins
Password change history

Step 9: Synthesize & Document

Use /document-in-case with findings summary:

Suspicious Login Triage for USER_ID from SOURCE_IP:
- User SIEM Summary: [...]
- Source IP GTI: [reputation, geo]
- Login Pattern: [normal/anomalous]
- Related Cases: [...]
- Recommendation: [Close as FP | Escalate to Tier 2]

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`LOGIN_VERDICT`	Assessment: `legitimate`, `suspicious`, or `malicious`
`ANOMALY_INDICATORS`	What made the login suspicious (impossible travel, new device, etc.)
`RELATED_ACTIVITY`	Other suspicious activity from user or source IP
`RISK_SCORE`	Numerical risk assessment (0-100) based on findings

Decision Matrix

Finding	Recommendation
Known VPN/corporate IP + normal pattern	Close as FP
User confirmed travel + MFA used	Close as Benign TP
Malicious IP reputation	Escalate
Impossible travel + no MFA	Escalate urgently
Multiple failures then success from new IP	Escalate
Pattern matches user's normal behavior	Close as FP

Key Patterns to Detect

Impossible Travel:

Login from NYC, then London 30 mins later
Check if VPN or cloud service could explain

Credential Stuffing:

Many failures across multiple accounts from same IP
Success after many failures

Account Takeover:

Login from new device/location
Followed by password change or MFA modification

Lateral Movement:

Same user logging into many systems rapidly
Unusual service account activity

---name: triage-suspicious-logindescription: Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.--- # Suspicious Login Triage Skill Guide initial triage of suspicious login alerts (impossible travel, untrusted location, multiple failed logins) for Tier 1 SOC Analysts. ## Inputs - `CASE_ID` - SOAR case ID containing the alert(s) - `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers from the case - *(Optional)* `USER_ID` - The user ID if known upfront - *(Optional)* `SOURCE_IP` - The source IP if known upfront ## Workflow ### Step 1: Get Case Context ``` secops-soar.get_case_full_details(case_id=CASE_ID) ``` ### Step 2: Extract Key Entities ``` secops-soar.list_events_by_alert(case_id=CASE_ID, alert_id=ALERT_ID) ``` Parse events to extract: - `USER_ID` - The user account - `SOURCE_IP` - The login source IP - `HOSTNAME` - The target/source hostname (if available) ### Step 3: User Context (SIEM) ``` secops-mcp.lookup_entity(entity_value=USER_ID) ``` Record: Recent activity, first/last seen, related alerts. ### Step 4: Source IP Enrichment Use `/enrich-ioc` with IOC_TYPE="IP Address": - GTI reputation and geolocation - SIEM entity summary - IOC match status ### Step 5: Hostname Context (if available) ``` secops-mcp.lookup_entity(entity_value=HOSTNAME) ``` ### Step 6: Recent Login Activity Search for login patterns over the last 96 hours: ``` secops-mcp.search_security_events( text='metadata.event_type IN ("USER_LOGIN", "AUTH_ATTEMPT") AND principal.user.userid = "USER_ID"', hours_back=96 ) ``` Analyze for: - Logins from unusual IPs - Successful logins after failures - Geographic anomalies (impossible travel) - Concurrent sessions from different locations ### Step 7: Check Related Cases Use `/find-relevant-case` with search terms: `[USER_ID, SOURCE_IP, HOSTNAME]` ### Step 8: (Optional) Identity Provider Check If IDP tools available (e.g., Okta): - Account status - MFA enrollment - Recent legitimate logins - Password change history ### Step 9: Synthesize & Document Use `/document-in-case` with findings summary: ``` Suspicious Login Triage for USER_ID from SOURCE_IP: - User SIEM Summary: [...] - Source IP GTI: [reputation, geo] - Login Pattern: [normal/anomalous] - Related Cases: [...] - Recommendation: [Close as FP | Escalate to Tier 2] ``` ## Required Outputs **After completing this skill, you MUST report these outputs:** | Output | Description | |--------|-------------| | `LOGIN_VERDICT` | Assessment: `legitimate`, `suspicious`, or `malicious` | | `ANOMALY_INDICATORS` | What made the login suspicious (impossible travel, new device, etc.) | | `RELATED_ACTIVITY` | Other suspicious activity from user or source IP | | `RISK_SCORE` | Numerical risk assessment (0-100) based on findings | ## Decision Matrix | Finding | Recommendation | |---------|----------------| | Known VPN/corporate IP + normal pattern | Close as FP | | User confirmed travel + MFA used | Close as Benign TP | | Malicious IP reputation | Escalate | | Impossible travel + no MFA | Escalate urgently | | Multiple failures then success from new IP | Escalate | | Pattern matches user's normal behavior | Close as FP | ## Key Patterns to Detect **Impossible Travel:** - Login from NYC, then London 30 mins later - Check if VPN or cloud service could explain **Credential Stuffing:** - Many failures across multiple accounts from same IP - Success after many failures **Account Takeover:** - Login from new device/location - Followed by password change or MFA modification **Lateral Movement:** - Same user logging into many systems rapidly - Unusual service account activity

Frequently asked questions