For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the local corpus first. Assumes the RAG is loaded with security content (cybersecurity preset, MITRE data, threat reports, runbooks). Prevents wasted external threat-intel calls and grounds recommendations in the team's actual playbooks.
Installs into .claude/skills of the current project.
Are you the author of Rag Security First?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/lyonzin-rag-security-first)
---
name: rag-security-first
description: For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the local corpus first. Assumes the RAG is loaded with security content (cybersecurity preset, MITRE data, threat reports, runbooks). Prevents wasted external threat-intel calls and grounds recommendations in the team's actual playbooks.
metadata:
type: rag-workflow
kind: domain
target: any-mcp-client
---
# rag-security-first — RAG-driven security workflow
## When to use this skill
Trigger this skill for any security-flavored task:
- Threat triage or incident response
- MITRE ATT&CK technique mapping (T1078, T1055, …)
- CVE lookup or vulnerability analysis
- Exploit / payload / attacker-technique questions
- Red team / blue team / purple team exercises
- CTF challenge analysis
- Detection engineering (Sigma / Snort / YARA / KQL / SPL / LQL rules)
- Defensive control validation
- Compliance / hardening questions
**Prerequisite:** the RAG should be loaded with security-relevant content. The [`cybersecurity` preset](../presets/cybersecurity.yaml) is optimized for this — it ships 8 categories, 200+ routing keywords, and 69 query expansions covering `sqli` → `SQL injection`, `privesc` → `privilege escalation`, etc.
---
## What this skill commits to
For security tasks, the corpus is **primary**:
1. Search the corpus **before** hitting any external threat-intel MCP (`mcp__cti__*`, `mcp__virustotal__*`, `mcp__shodan__*`).
2. Use the query-expansion mappings (`sqli` → `SQL injection`) — they exist for a reason.
3. Cite the MITRE technique ID + the internal runbook link.
4. Only escalate to external threat-intel when the corpus does not cover the specific IOC / CVE / technique in enough depth.
---
## Steps
1. **Classify the intent.** Is it:
- **Detection** — "we saw X in logs, is this bad?"
- **Response** — "we confirmed compromise, what now?"
- **Prevention** — "how do we harden against X?"
- **Research** — "how does X actually work?"
2. **Extract the security signature** from the user's message:
- MITRE ATT&CK ID (`T1078`, `T1078.001`, `TA0004`)
- CVE ID (`CVE-2024-1234`)
- Malware family (`Cobalt Strike`, `Mimikatz`, `LSASS dump`)
- Attack technique term (`Kerberoasting`, `AS-REP Roasting`, `pass-the-hash`)
- IOC (hash, domain, IP — treat as verbatim in the search)
3. **Search the corpus with the security preset in mind:**
```
search_knowledge(query="<signature> <intent>", max_results=5, min_score=0.15)
```
Example: `search_knowledge(query="LSASS dump credential access detection", max_results=5)`
4. **If the RAG has a routing preset,** the categories `redteam` / `blueteam` / `mitre` / `ctf` are likely present. Filter when specificity matters:
```
search_knowledge(query="lateral movement WinRM", category="blueteam", max_results=5)
```
5. **Read the top hits and build the answer around them.** Typical outputs to include:
| Section | Content |
|---|---|
| **Technique** | MITRE ATT&CK ID + name + tactic |
| **Detection** | log signals, EDR queries (KQL / SPL / LQL), Sigma rules — from corpus |
| **Response** | runbook steps from `blueteam` category or `def-*` skills |
| **Attacker view** | tools / commands from `redteam` category (authorized engagements only) |
| **References** | citations to corpus files + MITRE technique URL + CVE URL |
6. **Only escalate to external threat-intel MCPs when the corpus is thin on the specific IOC:**
```
# Only if RAG returns generic-only hits, not IOC-specific:
mcp__virustotal__vt_file_report(hash=...)
mcp__cti__ti_check_ioc(ioc=..., ioc_type="hash")
mcp__shodan__shodan_host(ip=...)
```
7. **After resolution**, chain to [`rag-index-decisions`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/maintenance/rag-index-decisions/SKILL.md) if the incident produced a new detection rule, runbook entry, or lesson.
---
## Examples
**Example 1 — MITRE-mapped detection question**
User: *"We saw process creation of `rundll32.exe comsvcs.dll MiniDump 632 dump.dmp full` on a workstation. Is this bad?"*
Agent:
```
search_knowledge(query="rundll32 comsvcs MiniDump LSASS credential dump",
max_results=5, min_score=0.15)
→ 4 hits: mitre-T1003.001-lsass.md (0.94), redteam-cred-dumping.md (0.82),
blueteam-lsass-detection.md (0.79), edr-tuning-lsass.md (0.71)
Reply: "Yes, high-confidence malicious [mitre-T1003.001-lsass.md].
**Technique:** MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory)
via the built-in `comsvcs.dll` MiniDump helper. Legitimate use of this
command is extremely rare.
**Detection signals** [blueteam-lsass-detection.md]:
- Process: `rundll32.exe` with cmdline containing `comsvcs.dll` + `MiniDump`
- Parent process: often `cmd.exe` or `powershell.exe` after initial access
- File write: `.dmp` file with LSASS-typical size (~50-500 MB)
**Immediate response** [runbooks/incident-lsass-dump.md]:
1. Isolate the host (network quarantine, do not power off — preserve memory)
2. Capture the dump before attacker retrieves it
3. Rotate credentials of every user logged on to that host (last 24h)
4. Kerberos: krbtgt reset if attacker had time to Golden Ticket
**Related ATT&CK:** T1078 (Valid Accounts, likely next step),
T1550 (Alternate Auth Material)."
```
**Example 2 — CVE lookup**
User: *"Is CVE-2024-3400 relevant to our infra?"*
Agent:
```
search_knowledge(query="CVE-2024-3400", max_results=5) → 0 hits (specific CVE not indexed)
search_knowledge(query="PAN-OS GlobalProtect vulnerability", max_results=5) → 2 hits
→ asset-inventory-perimeter.md (0.68), vuln-response-playbook.md (0.55)
Reply: "The corpus does not have CVE-2024-3400 specifically indexed. Checking external
sources... [chains to mcp__cti__vuln_cve(cve_id='CVE-2024-3400')]
From external threat intel: CVE-2024-3400 is a critical PAN-OS GlobalProtect command
injection (CVSS 10.0), actively exploited since March 2024.
**Relevance to your infra** [asset-inventory-perimeter.md]:
- Your perimeter inventory lists 2 PAN-OS firewalls in scope.
- Response playbook: [vuln-response-playbook.md] — priority PATCH within 24h
for internet-facing PAN-OS with GlobalProtect enabled.
**Next steps:**
1. Confirm PAN-OS version on those 2 firewalls
2. Check if GlobalProtect gateway feature is enabled (only vulnerable if yes)
3. If yes → apply hotfix per PAN advisory; if no → still upgrade but non-emergency
4. Hunt for IOCs from the campaign — chain to mcp__cti__ti_check_ioc"
```
**Example 3 — Red team, authorized engagement**
User: *"Doing an authorized internal pentest. Need Kerberoasting query and post-exploitation."*
Agent:
```
search_knowledge(query="Kerberoasting SPN request authorized pentest",
category="redteam", max_results=5)
→ 4 hits: kerberoasting-technique.md (0.91), rubeus-usage.md (0.83),
post-exploit-cred-cracking.md (0.75), opsec-considerations.md (0.68)
Reply: "**MITRE ATT&CK T1558.003** (Steal or Forge Kerberos Tickets: Kerberoasting)
[kerberoasting-technique.md].
**Enumeration:**
```powershell
Get-ADUser -Filter {ServicePrincipalName -ne \"$null\"} -Properties ServicePrincipalName
# or Impacket:
GetUserSPNs.py DOMAIN/user:pass -dc-ip <DC>
```
[kerberoasting-technique.md#enumeration]
**Extraction with Rubeus:**
```
Rubeus.exe kerberoast /outfile:hashes.txt /nowrap
```
[rubeus-usage.md]
**Cracking:**
```
hashcat -m 13100 hashes.txt rockyou.txt --force
```
[post-exploit-cred-cracking.md]
**OPSEC** [opsec-considerations.md]: EDRs flag Rubeus / GetUserSPNs by
default — use only from authorized C2 or bastion. Prefer `Rubeus /aes` to
avoid RC4 detection."
```
---
## Edge cases
- **Corpus is not security-loaded** — `list_categories()` returns no security-flavored categories. Skill still works but degrades: no runbook citations, more escalation to external threat-intel MCPs.
- **Sensitive engagement content** — never quote client-specific IOCs from one engagement in another. Sanitize before responding.
- **Unauthorized attacker technique request** — if the user is asking how to attack a system without authorization, this skill does NOT help. Refuse per general policy — RAG-first is about *how to search*, not *what to search for*.
- **Live IOC that should not be cached** — if the response includes a live C2 IP or malware hash, do NOT `add_from_url` it into the RAG. Cite once and move on.
---
## Related skills
- **[`rag-check-first`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/foundation/rag-check-first/SKILL.md)** — the base pattern (this is `check-first` with security priorities).
- **[`rag-cite-sources`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/foundation/rag-cite-sources/SKILL.md)** — extra important in security (auditable trail matters).
- **[`rag-troubleshoot`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/workflow/rag-troubleshoot/SKILL.md)** — incident triage often overlaps with debugging.
- **[`rag-index-decisions`](https://github.com/lyonzin/knowledge-rag/blob/master/skills/maintenance/rag-index-decisions/SKILL.md)** — after handling an incident, index the postmortem.
