orca-morning-briefing

# Orca Morning Briefing Skill Answers the question: **"What happened while I was away, and what needs my attention?"** Provides a security briefing for the last 24-72 hours covering new critical alerts, escalated alerts, attack path changes, compliance drift, exposure changes, CDR activity anomalies, crown jewel risks, and aging unactioned alerts. ## Usage ``` /orca-morning-briefing /orca-morning-briefing 72h /orca-morning-briefing week ``` Or natural language: - "morning briefing" - "what happened overnight?" - "brief me on the last 72 hours" - "daily security summary" - "what's new since yesterday?" ## Time Range | Argument | Period | When to Use | |----------|--------|-------------| | *(none)* | Last 24 hours | Daily morning check | | `72h` | Last 3 days | Monday morning / after weekend | | `week` | Last 7 days | Weekly review / returning from PTO | Map these to CDR `time_range` enum values: - 24h → `"last_24_hours"` - 72h → `"last_3_days"` - week → `"last_7_days"` ## Processing Logic ### Data Gathering Phase Run ALL of the following queries in parallel to minimize latency. Do not wait for one to finish before starting the next. #### Group 1: Alert Queries (via discovery_search) Run these `discovery_search` queries in parallel: **Query 1a: New critical alerts** ``` discovery_search: search_phrase: "critical open alerts" limit: 10 ``` **Query 1b: New high alerts** ``` discovery_search: search_phrase: "high severity open alerts" limit: 10 ``` **Query ...