Cybersecurity Pro

Cybersecurity Pro Skill

สกิลระดับมืออาชีพสำหรับ Cybersecurity Operations ครอบคลุม 22 domains: IR, DFIR, DevSecOps, SOC+SOAR, GitOps, Code Security Analysis, Container & Supply Chain, Threat Modeling & Risk, Compliance Frameworks, Cloud Security & CSPM, Zero Trust Architecture, AI/ML Security, API Security, Vulnerability Management, Threat Intelligence, Cross-Domain Integration, Security Governance & Executive Leadership, OT/ICS Security, Agentic AI Security, Post-Quantum Cryptography, Identity & Access Security, Web3 & Blockchain Security

When This Skill Activates / เมื่อใดที่สกิลนี้ทำงาน

This skill activates when prompts match any of the following trigger families. The list lives here in the body (not in the frontmatter description) to keep the per-entry description under Claude Code's 1536-character cap — Claude reads the body once the skill is invoked.

Incident Response & DFIR incident response, IR playbook, runbook, SOC triage, alert investigation, threat hunting, digital forensics, malware analysis, DFIR, escalation workflow, forensic report, chain of custody, evidence handling, log analysis, SIEM correlation, post-mortem, SOAR, security orchestration, automation, MITRE ATT&CK, NIST 800-61, ISO 27035

DevSecOps & Code Security DevSecOps, SAST, DAST, SCA, SBOM, CI/CD security, GitOps, security-as-code, OWASP, Semgrep, CodeQL, SARIF, variant analysis, code scanning, static analysis, CWE Top 25

Container & Supply Chain container security, Trivy, Grype, Dockerfile hardening, image scanning, supply chain, cosign, SLSA, NIST 800-190

Compliance & Risk compliance reports, threat modeling, security architecture, SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS, STRIDE, PASTA, risk assessment, PDPA, NIST 800-53, CIS Controls, CIS Benchmarks, gap analysis, control mapping, compliance audit

Cloud Security & CSPM cloud security, CSPM, AWS security, Azure security, GCP security, IAM policy, cloud misconfiguration, Prowler, ScoutSuite, CSA CCM, NIST 800-144, CIS Cloud Benchmarks

Zero Trust zero trust, ZTA, ZTNA, NIST 800-207, microsegmentation, SDP, never trust always verify, CISA Zero Trust, conditional access

AI/ML & Agentic AI AI security, LLM security, prompt injection, AI red team, MITRE ATLAS, AI governance, model security, AI risk, EU AI Act, AI RMF, OWASP LLM Top 10, ML-BOM, agentic AI, AI agent security, OWASP Agentic, ASI01, agent hijack, tool misuse, agent orchestration, ความปลอดภัย AI Agent, ความปลอดภัย AI

API Security API security, OWASP API, BOLA, API gateway, rate limiting, JWT security, OAuth security, API authentication, API inventory, API fuzzing, ความปลอดภัย API

Vulnerability Management & Threat Intelligence vulnerability management, CVSS, EPSS, KEV, patch management, vulnerability scan, Nessus, Qualys, vulnerability prioritization, SSVC, การจัดการช่องโหว่, threat intelligence, STIX, TAXII, IOC, indicator of compromise, threat feed, MISP, OpenCTI, TLP, intelligence sharing, ข่าวกรองภัยคุกคาม

Cross-Domain & Governance cross-domain, integration, end-to-end, workflow, lifecycle, orchestration, security pipeline, การบูรณาการ, multi-domain, security governance, CISO, CAIO, CAISO, board reporting, cyber risk governance, SEC disclosure, NIST CSF GOVERN, ISO 27014, C2M2, NACD, board oversight, governance framework, security maturity, executive leadership, ธรรมาภิบาลความปลอดภัย

OT/ICS OT security, ICS, SCADA, PLC, operational technology, NIST 800-82, IEC 62443, Purdue model, industrial control, OT/IT convergence, ความปลอดภัย OT, โครงสร้างพื้นฐานสำคัญ, DCS, RTU, HMI, Modbus, DNP3, OPC UA, BACnet, NERC CIP, MITRE ATT&CK for ICS, OT incident response

Post-Quantum Cryptography post-quantum, PQC, quantum cryptography, ML-KEM, ML-DSA, SLH-DSA, FIPS 203, crypto-agility, CNSA 2.0, การเข้ารหัสควอนตัม

Identity & Web3 identity security, IAM, FIDO2, passkeys, non-human identity, machine identity, ITDR, identity governance, NIST 800-63, ความปลอดภัย Identity, smart contract, Web3, blockchain security, DeFi, wallet security, Solidity, OWASP Smart Contract, reentrancy, flash loan, ความปลอดภัย Blockchain

Thai prompts การตอบสนองต่อเหตุการณ์, วิเคราะห์ภัยคุกคาม, ความปลอดภัยไซเบอร์, นิติวิทยาศาสตร์ดิจิทัล, การวิเคราะห์ code, ความปลอดภัย container, การปฏิบัติตามกฎระเบียบ, การจำลองภัยคุกคาม, ความปลอดภัยบนคลาวด์, สถาปัตยกรรม Zero Trust

Post-pentest defensive (Shannon handoff) Shannon handoff, post-pentest defensive, ผล Shannon, defensive security documents, สร้าง defensive docs จาก Shannon, handoff-manifest

Language Policy / นโยบายภาษา

Output all documents in bilingual format:

• Use Thai as the primary prose language for descriptions, explanations, procedures
• Use English for all technical terms, tool names, commands, code, framework references
• Format: Thai prose with inline English technical terms (ไม่ต้องแปลคำศัพท์เทคนิค)
• Section headers: Thai followed by English in parentheses, e.g. ## การจัดการเหตุการณ์ (Incident Handling)

Example style:

เมื่อได้รับ alert จาก SIEM ให้ทำการ triage ตาม severity level โดยตรวจสอบ IOC (Indicators of Compromise) ผ่าน Threat Intelligence platform ก่อน escalate

Frameworks & Standards

All outputs MUST reference the appropriate framework(s):

When producing any output, map actions to relevant framework controls. For incident analysis, always include MITRE ATT&CK Tactic/Technique IDs (e.g., T1566.001).

Output Domains

This skill produces outputs across 22 domains. Identify which domain(s) the user needs and read the corresponding reference file BEFORE generating output:

1. Incident Response Playbooks & Runbooks

Read references/ir-playbooks.md

Produce structured IR playbooks and operational runbooks for specific incident types. Covers: Phishing, Ransomware, Data Breach, DDoS, Insider Threat, Supply Chain Attack, Cloud Security Incident, and custom scenarios.

2. Security Analysis Reports & Forensic Reports

Read references/dfir-reports.md

Produce professional forensic investigation reports, threat analysis reports, malware analysis reports, and root cause analysis documents. Covers: Evidence handling, chain of custody, timeline reconstruction, IOC extraction, memory/disk/network forensics documentation.

3. DevSecOps Pipeline Configs

Read references/devsecops-pipeline.md

Produce security-integrated CI/CD pipeline configurations, security-as-code templates, and DevSecOps maturity assessments. Covers: SAST, DAST, SCA, SBOM, container security, IaC scanning, secret detection, dependency management, and compliance gates.

4. SOC Triage Procedures & Escalation Workflows

Read references/soc-operations.md

Produce SOC operational procedures for L1/L2/L3 analysts, escalation matrices, alert handling workflows, and shift handover templates. Covers: Alert triage, investigation procedures, threat hunting queries, SIEM correlation rules, and KPI/metrics dashboards.

5. GitOps Security Workflows

Read references/gitops-security.md

Produce GitOps-native security configurations, policy-as-code frameworks, and automated security remediation workflows. Covers: ArgoCD/Flux security policies, OPA/Gatekeeper constraints, Git-based secret management, drift detection, and compliance automation.

6. Code Security Analysis

Read references/code-security-analysis.md

Produce static code security analysis configurations, custom scanning rules, and vulnerability hunting methodologies. Covers: Semgrep rules and rulesets, CodeQL queries and taint tracking, SARIF result processing and aggregation, variant analysis methodology, combined CI/CD security pipelines.

7. Container & Supply Chain Security

Read references/container-supply-chain.md

Produce container security hardening guides, vulnerability scanning configurations, SBOM generation workflows, and supply chain security checklists. Covers: Dockerfile hardening, Trivy/Grype scanning, Syft SBOM generation, cosign image signing, runtime SecurityContext, Falco rules, CIS Docker Benchmark compliance.

8. Threat Modeling & Risk Assessment

Read references/compliance-threat-modeling.md

Produce threat modeling documents, risk assessment reports, and compliance quick references. Covers: SOC 2 readiness, ISO 27001 ISMS, STRIDE threat modeling, PASTA attack trees, risk registers, risk matrices, Thai legal requirements (พ.ร.บ. ไซเบอร์, PDPA).

9. Compliance Frameworks

Read references/compliance-frameworks.md

Produce detailed compliance framework assessments, gap analyses, control mappings, and compliance roadmaps for major regulatory frameworks. Covers: NIST SP 800-53 Rev 5 (20 control families, impact baselines), PCI DSS v4.0 (12 requirements, SAQ decision tree), GDPR (data subject rights, DPIA, breach notification), HIPAA (administrative/physical/technical safeguards), CIS Controls v8.1 (18 control groups, IGs), cross-framework mapping tables.

10. Cloud Security & CSPM

Read references/cloud-security-cspm.md

Produce cloud security audit checklists, IAM policy reviews, CSPM configurations, and cloud hardening guides for AWS, Azure, and GCP environments. Covers: Shared responsibility model, IAM policy templates, storage security audits, network security controls, CSPM tool configurations (Prowler, ScoutSuite, Cloud Custodian), cloud audit logging, IaC security scanning, CIS Cloud Benchmarks compliance.

11. Zero Trust Architecture

Read references/zero-trust-architecture.md

Produce Zero Trust maturity assessments, implementation roadmaps, microsegmentation policies, and ZTNA migration guides. Covers: NIST SP 800-207 framework, 5 pillars (Identity, Device, Network, App, Data), CISA Zero Trust Maturity Model, conditional access policies, service mesh configurations, identity-aware proxy patterns, ZTA implementation roadmaps.

12. AI/ML Security

Read references/ai-ml-security.md

Produce AI security assessments, LLM guardrail configurations, AI red team playbooks, and AI governance policy templates. Covers: OWASP Top 10 for LLM Applications, prompt injection defense, MITRE ATLAS threat mapping, NIST AI Risk Management Framework, EU AI Act compliance, model supply chain security (ML-BOM), AI incident response procedures, AI red teaming methodology.

13. API Security

Read references/api-security.md

Produce API security assessments, authentication architecture reviews, API gateway configurations, and API security testing plans. Covers: OWASP API Security Top 10 2023, JWT validation, OAuth 2.0 BCP (RFC 9700), API gateway security patterns (Kong/APISIX), API inventory & discovery, API fuzzing, API security CI/CD integration.

14. Vulnerability Management & Prioritization

Read references/vulnerability-management.md

Produce vulnerability management programs, prioritization frameworks, SLA templates, patch management workflows, and vulnerability metrics dashboards. Covers: CVSS v4.0 scoring, EPSS exploit prediction, CISA KEV catalog, SSVC decision trees, scanning tool configurations (Nessus/Qualys/OpenVAS/Nuclei/Trivy), patch management automation, risk acceptance workflows, vulnerability reporting.

15. Threat Intelligence & IOC Management

Read references/threat-intelligence.md

Produce threat intelligence program designs, STIX/TAXII integration templates, IOC lifecycle management workflows, and intelligence sharing procedures. Covers: STIX 2.1 object model (SDO/SRO/SCO), TAXII 2.1 server/client configuration, TI platform setup (MISP, OpenCTI), IOC lifecycle management, threat feed integration, intelligence sharing (TLP 2.0, ISACs), TI-driven detection and hunting, SOAR automation.

16. Cross-Domain Integration Scenarios

Read references/cross-domain-integration.md

Produce end-to-end security workflow designs, cross-domain SOAR playbooks, integration architecture diagrams, and multi-domain orchestration templates. Covers: IR lifecycle (TI→SOC→IR→DFIR), vulnerability-to-exploit pipeline, supply chain security pipeline (Code→Container→DevSecOps→GitOps→SOC), cloud compliance posture (Compliance→Cloud→ZeroTrust→VulnMgmt), AI/API threat surface (API→AI/ML→ThreatModel→Code), integration orchestration patterns, cross-domain metrics and KPIs, NIST CSF 2.0 mapping.

17. Security Governance & Executive Leadership

Read references/security-governance-executive.md

Produce security governance frameworks, board reporting templates, maturity assessments, and executive leadership role definitions. Covers: NIST CSF 2.0 GOVERN function (6 categories), ISO 27014 governance processes, C2M2 maturity model, CISO/CAIO/CAISO role definitions and RACI matrices, SEC 8-K/10-K cybersecurity disclosure, board KPI dashboards, AI governance at executive level, governance program implementation roadmaps.

18. OT/ICS Security

Read references/ot-ics-security.md

Produce OT/ICS security assessments, network segmentation designs, SCADA hardening guides, OT incident response plans, and industrial control system security checklists. Covers: NIST SP 800-82 Rev.3 framework, IEC 62443 zones and conduits, Purdue Model (ISA-95) network architecture, OT asset discovery (passive/active), industrial protocol security (Modbus, DNP3, OPC UA, BACnet), MITRE ATT&CK for ICS technique mapping, OT-specific incident response (safety-first), PLC/HMI/SCADA hardening, Thai CII requirements under พ.ร.บ. ไซเบอร์ 2562.

General Output Rules

1. Structure: Use consistent document templates per domain (defined in reference files)
2. Severity Classification: Always use a standard severity scale:
   • Critical (วิกฤต) / High (สูง) / Medium (ปานกลาง) / Low (ต่ำ) / Informational (ข้อมูล)
3. Actionable Steps: Every procedure must have clear, numbered steps that a SOC analyst can follow
4. Tool References: When mentioning tools, include both commercial and open-source alternatives
5. MITRE Mapping: For any attack/threat scenario, include ATT&CK Tactic + Technique IDs
6. Time-Sensitivity Markers: Mark steps with SLA expectations where applicable
   • e.g., ⏱ SLA: ตอบสนองภายใน 15 นาที (Critical), 1 ชั่วโมง (High)
7. Output Format: Default to .docx for formal reports, .md for operational docs. If the user requests a specific format, use that instead.
8. Template Variables: ใช้ placeholders เหล่านี้ในทุก output templates:
   • {ORG_NAME} — ชื่อองค์กร (ถามผู้ใช้ถ้ายังไม่ทราบ)
   • {DATE} — วันที่สร้างเอกสาร (ใช้วันปัจจุบัน)
   • {INDUSTRY} — ประเภทอุตสาหกรรม (ถามผู้ใช้ถ้ายังไม่ทราบ)
   • {ANALYST_NAME} — ชื่อผู้จัดทำ (ถามผู้ใช้ถ้ายังไม่ทราบ) Replace with actual values when user provides them, otherwise keep as placeholders.

Quick Decision Tree

User request
├── mentions "incident" / "เหตุการณ์" / "IR" / "playbook" / "runbook" / "post-mortem"
│   → Domain 1: IR Playbooks (read references/ir-playbooks.md)
│
├── mentions "forensic" / "นิติวิทยาศาสตร์" / "investigation" / "evidence" / "malware analysis"
│   → Domain 2: DFIR Reports (read references/dfir-reports.md)
│
├── mentions "pipeline" / "CI/CD" / "DAST" / "DevSecOps" / "shift-left"
│   → Domain 3: DevSecOps (read references/devsecops-pipeline.md)
│
├── mentions "SOC" / "triage" / "alert" / "escalation" / "L1" / "L2" / "L3" / "SOAR"
│   → Domain 4: SOC Operations (read references/soc-operations.md)
│
├── mentions "GitOps" / "ArgoCD" / "Flux" / "policy-as-code" / "OPA" / "drift"
│   → Domain 5: GitOps Security (read references/gitops-security.md)
│
├── mentions "Semgrep" / "CodeQL" / "SARIF" / "SAST" / "code scan" / "variant analysis" / "วิเคราะห์ code"
│   → Domain 6: Code Security Analysis (read references/code-security-analysis.md)
│
├── mentions "container" / "Docker" / "Trivy" / "Grype" / "SBOM" / "image scan" / "supply chain" / "Dockerfile"
│   → Domain 7: Container & Supply Chain (read references/container-supply-chain.md)
│
├── mentions "threat model" / "STRIDE" / "PASTA" / "risk assessment" / "risk matrix"
│   / "SOC 2" / "ISO 27001" / "PDPA" / "การจำลองภัยคุกคาม"
│   → Domain 8: Threat Modeling & Risk (read references/compliance-threat-modeling.md)
│
├── mentions "NIST 800-53" / "PCI DSS" / "PCI-DSS" / "GDPR" / "HIPAA" / "CIS Controls"
│   / "gap analysis" / "gap assessment" / "control mapping" / "compliance audit"
│   / "compliance roadmap" / "compliance framework" / "การปฏิบัติตามกฎระเบียบ"
│   → Domain 9: Compliance Frameworks (read references/compliance-frameworks.md)
│
├── mentions "cloud security" / "CSPM" / "AWS security" / "Azure security" / "GCP security"
│   / "IAM policy" / "cloud misconfiguration" / "Prowler" / "ScoutSuite" / "CSA CCM"
│   / "cloud audit" / "cloud hardening" / "ความปลอดภัยบนคลาวด์"
│   → Domain 10: Cloud Security & CSPM (read references/cloud-security-cspm.md)
│
├── mentions "zero trust" / "ZTA" / "ZTNA" / "NIST 800-207" / "microsegmentation"
│   / "SDP" / "never trust always verify" / "conditional access"
│   / "สถาปัตยกรรม Zero Trust"
│   → Domain 11: Zero Trust Architecture (read references/zero-trust-architecture.md)
│
├── mentions "AI security" / "LLM security" / "prompt injection" / "AI red team"
│   / "MITRE ATLAS" / "AI governance" / "model security" / "AI risk" / "EU AI Act"
│   / "AI RMF" / "OWASP LLM" / "ML-BOM" / "ความปลอดภัย AI"
│   → Domain 12: AI/ML Security (read references/ai-ml-security.md)
│
├── mentions "API security" / "OWASP API" / "BOLA" / "API gateway" / "rate limiting"
│   / "JWT security" / "OAuth security" / "API authentication" / "API inventory"
│   / "API fuzzing" / "ความปลอดภัย API"
│   → Domain 13: API Security (read references/api-security.md)
│
├── mentions "vulnerability management" / "CVSS" / "EPSS" / "KEV" / "patch management"
│   / "vulnerability scan" / "Nessus" / "Qualys" / "SSVC" / "vulnerability prioritization"
│   / "การจัดการช่องโหว่"
│   → Domain 14: Vulnerability Management (read references/vulnerability-management.md)
│
├── mentions "threat intelligence" / "STIX" / "TAXII" / "IOC" / "threat feed"
│   / "MISP" / "OpenCTI" / "TLP" / "intelligence sharing" / "indicator of compromise"
│   / "ข่าวกรองภัยคุกคาม"
│   → Domain 15: Threat Intelligence (read references/threat-intelligence.md)
│
├── mentions "integration" / "end-to-end" / "cross-domain" / "workflow" / "lifecycle"
│   / "orchestration" / "การบูรณาการ" / "security pipeline" / "multi-domain"
│   → Domain 16: Cross-Domain Integration (read references/cross-domain-integration.md)
│
├── mentions "security governance" / "CISO role" / "CISO reporting" / "CAIO" / "CAISO" / "board reporting"
│   / "cyber risk governance" / "SEC disclosure" / "NIST CSF GOVERN" / "ISO 27014"
│   / "C2M2" / "NACD" / "board oversight" / "governance framework"
│   / "security maturity" / "executive leadership" / "ธรรมาภิบาลความปลอดภัย"
│   → Domain 17: Security Governance (read references/security-governance-executive.md)
│
├── mentions "Shannon findings" / "Shannon handoff" / "post-pentest" / "defensive docs"
│   / "ผล Shannon" / "สร้าง defensive" / "handoff-manifest"
│   → Post-Pentest Mode: Shannon Integration (read handoff manifest, multi-domain orchestration)
│
├── mentions "OT security" / "ICS" / "SCADA" / "PLC" / "Purdue" / "operational technology"
│   / "industrial control" / "NIST 800-82" / "IEC 62443" / "OT/IT convergence"
│   / "HMI" / "RTU" / "DCS" / "Modbus" / "DNP3" / "OPC UA" / "BACnet"
│   / "NERC CIP" / "ATT&CK for ICS" / "ความปลอดภัย OT" / "โครงสร้างพื้นฐานสำคัญ"
│   → Domain 18: OT/ICS Security (read references/ot-ics-security.md)
│
├── mentions "agentic AI" / "AI agent" / "agent security" / "OWASP Agentic" / "tool misuse"
│   / "agent hijack" / "multi-agent" / "ความปลอดภัย AI Agent"
│   → Domain 19: Agentic AI Security (read references/agentic-ai-security.md)
│
├── mentions "post-quantum" / "PQC" / "quantum cryptography" / "ML-KEM" / "ML-DSA"
│   / "crypto-agility" / "CNSA 2.0" / "FIPS 203" / "การเข้ารหัสควอนตัม"
│   → Domain 20: Post-Quantum Cryptography (read references/post-quantum-cryptography.md)
│
├── mentions "identity security" / "IAM" / "FIDO2" / "passkeys" / "machine identity"
│   / "ITDR" / "non-human identity" / "NIST 800-63" / "ความปลอดภัย Identity"
│   → Domain 21: Identity & Access Security (read references/identity-access-security.md)
│
├── mentions "smart contract" / "Web3" / "blockchain" / "DeFi" / "Solidity"
│   / "wallet security" / "flash loan" / "reentrancy" / "ความปลอดภัย Blockchain"
│   → Domain 22: Web3 & Blockchain Security (read references/web3-blockchain-security.md)
│
└── unclear / multiple domains
    → Ask user to clarify, or if multi-domain workflow → Domain 16

Guided Domain Selection (Fallback)

เมื่อ keyword matching ไม่ชัดเจน ให้ถามผู้ใช้ 2-3 คำถามเพื่อ narrow down:

Question 1: ประเภทงาน (Task Type)

• "ต้องการสร้างเอกสาร/นโยบาย" → Governance cluster (D8, D9, D17)
• "ต้องการวิเคราะห์/ตรวจสอบ" → Analysis cluster (D6, D14, D15)
• "ต้องการสร้าง playbook/procedure" → Operations cluster (D1, D4, D7)
• "ต้องการวางแผน architecture" → Architecture cluster (D10, D11, D20, D21)
• "ต้องการ audit/security review" → Review cluster (D3, D13, D22)
• "ต้องการจัดการกับ AI/Agent" → AI cluster (D12, D19)

Question 2: ประเภท asset (Asset Type)

• "Application/Code" → D3, D6, D13, D22
• "Infrastructure/Cloud" → D5, D10, D11, D18
• "Data/Identity" → D9, D20, D21
• "Organization/People" → D8, D17, D14
• "AI/ML Systems" → D12, D19

Question 3: เป้าหมาย (Goal)

• Narrow further based on specific goal within the cluster
• ถ้าเป็น incident/threat → D1, D2, D4, D15
• ถ้าเป็น compliance/audit → D8, D9, D17
• ถ้าเป็น design/architecture → D5, D10, D11, D20
• ถ้าเป็น monitoring/detection → D4, D14, D15

ถ้ายังไม่ชัดเจนหลังจาก 3 คำถาม → ใช้ Domain 16 (Cross-Domain Integration) เพื่อเชื่อมโยงหลาย domains

File Output Strategy

• Formal Reports (forensic reports, compliance docs): Use the docx skill to produce .docx
• Operational Docs (playbooks, runbooks, triage procedures): Produce as .md files
• Pipeline Configs: Produce as appropriate config files (.yml, .yaml, .json, .rego, .tf)
• Combined Packages: When producing a complete set (e.g., full IR package), create a folder structure with all relevant files

Post-Pentest Integration Mode (Shannon Handoff)

เมื่อ user มาจาก Shannon Phase 5 พร้อม handoff manifest:

Step 1: ค้นหา Handoff Manifest

• User ระบุ path → อ่าน handoff-manifest.json
• ถ้าไม่ระบุ → ค้นหา: find ~/shannon-tool/audit-logs/*/handoff/handoff-manifest.json (latest)
• ถ้าไม่พบ manifest → ถาม user ว่ามี Shannon deliverables directory ไหม แล้ว fallback ไป Domain 16

Step 2: อ่าน Shannon Deliverables (Parallel Read)

อ่านไฟล์เหล่านี้พร้อมกัน (parallel Read calls):

• handoff-manifest.json → metadata + document requests
• comprehensive_security_assessment_report.md → all findings summary
• auth_exploitation_evidence.md / authz_exploitation_evidence.md → PoC details (ถ้ามี)
• data_security_audit_deliverable.md → transport security findings (ถ้ามี)

Step 3: สร้างเอกสารตาม requested_documents

สร้างไฟล์ลง output_dir (จาก manifest):

ถ้า requested_documents มี identifier ที่ไม่รู้จัก → แจ้ง user: "ไม่รู้จัก document type '[identifier]' — ข้ามและสร้างเอกสารที่รู้จักแทน"

Step 4: แสดงสรุป

แสดงรายการเอกสารที่สร้าง + file sizes + verification checklist:

✓ สร้างเอกสาร defensive security จาก Shannon findings เรียบร้อย:
  1. vuln-prioritization-matrix.md — [X] findings จัดลำดับ
  2. ir-playbook.md — playbook สำหรับ [finding type]
  ...
ไฟล์ทั้งหมดอยู่ที่: [output_dir]

Cross-reference: ดู references/cross-domain-integration.md Scenario: Post-Pentest Defensive Documentation สำหรับ data flow diagram

Quality Checklist

Before finalizing any output, verify:

• ภาษาไทยถูกต้อง ใช้คำศัพท์เทคนิคเป็นภาษาอังกฤษ
• Framework references are accurate and specific (not generic)
• MITRE ATT&CK IDs are real and correctly mapped
• Procedures are step-by-step and actionable
• Severity levels and SLAs are defined
• Tool recommendations include open-source options
• Templates are complete and ready to use (ไม่มี placeholder ที่ไม่จำเป็น)