Project OverviewDesigned for government service platforms and government-enterprise security operations centers, this Skill adapts to multiple security platforms such as One Wall, Tianyan, SOC / WAF / NDR for intelligent triage of traffic attack alerts, transforming scattered alerts into a structured triage workflow covering attack intent identification, vulnerability exploitability assessment, successful exploit verification, business legitimacy checks, impact rating, and notification decisions.

Tech StackBuilt on the Codex Skill framework, using Python, JSON, Markdown / YAML to orchestrate triage rules; integrates HTTP / WAF logs, application and database audits, EDR host logs, and OOB callback verification, connects to CISA KEV, FIRST EPSS, NVD CVE APIs, and iterates continuously via GitHub Actions.

Core FeaturesEstablishes a four-level attack determination system, forming an evidence chain from request-response, multi-source logs, asset exposure, and historical handling records, covering weak passwords, unauthorized access, injection attacks, WebShells, component exposure, and scanner simulation traffic, automatically outputting triage conclusions, evidence, handling recommendations, and remediation advice.

Project OutcomesPlayback of anonymized historical alert samples shows triage accuracy above 90%; after deployment, unified notification standards for government-enterprise alert pre-screening were established, with the core Skill size reduced by 56% and split into on-demand modules.

Project OverviewLeveraging the Henan Province Digital Government "One Wall" security operations support platform, this project provides ongoing security operations for 35 unified government information systems on the government cloud, covering the full flow of traffic attack detection, defense validation, and alert triage, forming a closed loop of "monitor - triage - respond - remediate".

Tech StackIntegrates capabilities from QiAnXin Tianyan, SOC, NDR, WAF / IDS, and full-traffic situational awareness platforms, using multi-source alert correlation, full-traffic replay, exploit chain analysis, attack success validation, protocol behavior analysis, false positive attribution, and whitelist strategies to build attack evidence chains.

Core FeaturesCovers attack scenarios including vulnerability scanning, weak password brute force, unauthorized access, web injection, command execution, WebShell communication, and abnormal outbound connections; distinguishes real attacks, vulnerability exposure, blocked attacks, platform false positives, scanner simulation traffic, and normal business access, outputting standardized handling recommendations.

Project OutcomesOn average, monitors and handles about 2,005 malicious attack alerts daily, reducing false positives/negatives and manual review costs, shortening risk response time and vulnerability exposure windows, and ensuring zero major security incidents during major provincial platform events.

Project OverviewDesigned for government and enterprise SOC environments, this Agentic alert investigation workflow is built on LangGraph. It chains alert normalization, investigation planning, constrained tool calls, RAG evidence retrieval, risk assessment, human approval, and report generation into a testable, traceable stateful process, with CLI, MCP stdio, FastAPI, and Docker entry points.

Tech StackBuilt on Python 3.11/3.12, the core investigation service uses LangGraph, MCP 1.x, Pydantic v2, and FastAPI, with Pytest, Ruff, Docker Compose, and GitHub Actions for engineering testing and continuous delivery.

Core FeaturesExposes five read-only security tools via an MCP Server, constrained by schema whitelisting and retry mechanisms; implements CISA KEV intelligence sync with auditable snapshots, an EvidenceGate evidence gate, human approval for high-risk actions, and dual-mode fallback between rule engine and local LLM.

Project OutcomesCovers 7 benchmark investigation scenarios, with all metrics passing for retrieval recall, tool invocation, citation validity, conclusion accuracy, and intelligence traceability; all 45 unit tests and multi-environment CI gates pass.