[THREAT-698] PantherAI Skills

[alessandrarizzo]

Background

Blast-radius workflow skills — IR-style scoping for a confirmed-compromised principal ("what else did they touch?"):

Skill	Scope
aws_blast_radius	IAM users/roles, assumed-role sessions, access keys, EC2 instances — walks the AssumeRole chain across accounts
azure_blast_radius	Entra users, service principals, managed identities — scopes both planes (Entra ID + ARM) and walks cross-plane chains (cred-add → auth-as-SP → RBAC → elevateAccess)
gcp_blast_radius	Users, service accounts, SA keys — walks the SA impersonation chain (GenerateAccessToken/SignJwt/actAs) across projects
kubernetes_blast_radius	Users, service accounts, nodes — provider-agnostic (EKS/GKE/AKS via the unified UDM), walks RBAC expansion, token minting, and pod-exec chains

All four share the same 8-step skeleton: normalize the principal → anchor on existing alerts/detections → confirm log sources → tiered timeline (W1 ±3d / W2 campaign / W3 lookback) → walk the identity chain (capped at 3 hops) → co-occurring entities (capped at 2 hops) → classify by impact and map to deployed detections → structured blast-radius report. Key principles baked in: reuse deployed detections and saved queries before writing ad-hoc SQL, failed/denied calls are signal, every query bounded by LIMIT + p_event_time, strictly read-only and advisory.

Security knowledge primitives — reference skills mapping raw audit activity to attacker-impact categories, consumed by the blast-radius skills via DependsOn:

• aws_security_knowledge — CloudTrail eventName → impact buckets, AKIA/ASIA/AROA identifier decoding, known attack chains (PassRole privesc, snapshot exfil, golden SAML)
• azure_security_knowledge — dual-plane (Entra operationName + ARM provider ops), cross-referenced with Microsoft's Azure Threat Research Matrix (ATRM)
• gcp_security_knowledge — methodName → impact buckets, principalEmail identity decoding, metadata-SSRF and actAs escalation patterns
• kubernetes_security_knowledge — verb+resource+subresource → impact buckets, principal decoding (system:anonymous, system:serviceaccount:*, system:masters), container-escape primitives

Each maps techniques to deployed Panther rulesets by MITRE tactic/technique ID, and routes uncovered techniques to coverage_gap_analysis.

Standalone skills:

• coverage_gap_analysis — cross-references MITRE ATT&CK techniques (named, from an advisory URL, or by tactic) against active log sources and deployed detections; outputs a coverage table ranked by remediation effort
• ioc_enrichment_check — per-indicator reputation + activity check scoped to Panther's built-in enrichments (GreyNoise/VT/OTX), data lake, and alert history; "silence is a finding, not a clean verdict"
• threat_intel_feed_catalog — external feed catalog (supply-chain/npm, APT reporting, machine-readable IoC feeds) with fetch URLs, formats, and extraction patterns; complements ioc_enrichment_check as the external layer

Conventions

• Format follows the existing Okta skills: quoted top-level scalars, single-line quoted Description, SkillName without _skill suffix, explicit DependsOn: []/RequiredTools: [], 2-space indentation
• Knowledge primitives are tagged knowledge-primitive and carry no ToolMessage; workflow skills declare their full toolset in RequiredTools
• All skills are read-only — containment and rule changes are recommendations only
• All sample identifiers are placeholders (RFC 5737 IPs, example ARNs/UPNs)

Changes

Testing

[cursor]

PR Summary

Low Risk
Adds read-only prompt/skill YAML only; no runtime, auth, or detection rule changes—main risk is large prompt surface area and reliance on correct Panther AI tool wiring at load time.

Overview
Adds 11 new PantherAI skill definitions under skills/ for incident response, detection coverage, and threat intel—no application code changes.

Blast-radius workflows (aws_blast_radius, azure_blast_radius, gcp_blast_radius, kubernetes_blast_radius) share an 8-step read-only IR pattern: normalize the compromised principal, start from existing alerts/detections and saved queries, confirm log sources, build tiered timelines (W1/W2/W3), walk cloud-specific identity chains (AssumeRole, Entra+ARM, SA impersonation, RBAC/exec), pivot co-occurring entities (caps: 3-hop chains, 2-hop pivots), classify impact via paired knowledge skills, and emit a structured blast-radius report. Ad-hoc datalake SQL is explicitly a gap-filler behind bounded LIMIT + p_event_time queries.

Knowledge primitives (aws_security_knowledge, azure_security_knowledge, gcp_security_knowledge, kubernetes_security_knowledge) supply MITRE/ATRM-oriented audit-action taxonomies and “map to deployed detections” guidance; each blast-radius skill DependsOn its matching primitive.

Standalone skills: coverage_gap_analysis (techniques vs log sources + enabled detections, remediation-ranked table), ioc_enrichment_check (GreyNoise/VT/OTX + lake activity + alerts only; silence ≠ clean), and threat_intel_feed_catalog (external feed URLs/parsing for multi-feed sweeps, complements in-platform IoC check).

^{Reviewed by Cursor Bugbot for commit c16b013. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a6c1e1. Configure here.}