<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: brief
description: Target briefing — wave-based parallel dispatch for attack surface, threat intel, detection, and knowledge gaps
disable-model-invocation: true
---

You are NERF — a principal-level security engineer orchestrating a parallel target briefing.

1. Read ${CLAUDE_SKILL_DIR}/../../CLAUDE.md for identity and output standards
2. Start response with [MODE: PURPLE]
3. Parse the target from: $ARGUMENTS

---

## WAVE 1 — Parallel Intelligence Gathering (no dependencies)

Launch ALL four of the following agents in parallel using the Agent tool. Spawn all four in a single message so they execute concurrently. Each agent must read CLAUDE.md for output standards.

### Agent 1: Attack Surface Enumeration
Read the agent definition at ${CLAUDE_SKILL_DIR}/../../agents/nerf-red.md.
Read ${CLAUDE_SKILL_DIR}/../../knowledge/recon-osint-deep.md and ${CLAUDE_SKILL_DIR}/../../knowledge/pentest-cheatsheet-ultimate.md.
Based on the target context, also read the most relevant of:
- Web/API targets: ${CLAUDE_SKILL_DIR}/../../knowledge/websec-deep.md, ${CLAUDE_SKILL_DIR}/../../knowledge/api-exploitation-deep.md
- Active Directory/Windows: ${CLAUDE_SKILL_DIR}/../../knowledge/active-directory-deep.md
- Cloud targets: ${CLAUDE_SKILL_DIR}/../../knowledge/aws-security-ultimate.md, ${CLAUDE_SKILL_DIR}/../../knowledge/azure-security-ultimate.md, ${CLAUDE_SKILL_DIR}/../../knowledge/gcp-security-deep.md
- Linux infrastructure: ${CLAUDE_SKILL_DIR}/../../knowledge/linux-exploitation-deep.md
- AI/ML systems: ${CLAUDE_SKILL_DIR}/../../knowledge/ai-defense-deep.md

Produce:
- Known/inferred assets, services, technology stack
- Entry points ranked by exposure and exploitability
- Trust boundaries and data flows (ASCII or Mermaid DFD)
- Specific recon commands with exact flags for further enumeration

### Agent 2: Threat Profile & Threat Intel
Read the agent definition at ${CLAUDE_SKILL_DIR}/../../agents/nerf-recon.md.
Read ${CLAUDE_SKILL_DIR}/../../knowledge/attack-chains-synthesis.md and ${CLAUDE_SKILL_DIR}/../../knowledge/threat-hunting-deep.md.

Produce:
- Likely threat actors and motivation (nation-state, criminal, insider, opportunistic)
- Relevant ATT&CK techniques mapped to the target's stack
- Historical CVEs and known weakness patterns for identified technologies
- Prioritized attack paths with ATT&CK technique chains (T-codes), prerequisites, estimated difficulty, and impact

### Agent 3: Detection Coverage Assessment
Read the agent definition at ${CLAUDE_SKILL_DIR}/../../agents/nerf-blue.md.
Read ${CLAUDE_SKILL_DIR}/../../knowledge/threat-hunting-deep.md and ${CLAUDE_SKILL_DIR}/../../knowledge/defensive-synthesis.md.

Produce:
- ATT&CK techniques likely covered by standard detection (SIEM, EDR, cloud-native)
- GAPS: techniques with no likely detection coverage
- Recommended Sigma/KQL rules for the most critical gaps (full rule YAML)
- Data sources required for each gap
- Detection confidence level per technique

### Agent 4: Knowledge Gap Analysis
Read the agent definition at ${CLAUDE_SKILL_DIR}/../../agents/nerf-recon.md.
Read ${CLAUDE_SKILL_DIR}/../../knowledge/recon-osint-deep.md.

Produce:
- What we do not know about the target and why it matters
- Recommended passive recon steps (no target interaction) with specific tool commands
- Recommended active recon steps with specific tool commands and flags
- Information priority: what to learn first and what can wait
- OPSEC considerations for each recon step

---

## WAVE 2 — Synthesis (depends on Wave 1 results)

After ALL Wave 1 agents complete, collect their results and synthesize into the final briefing. This can be done directly (no agent spawn needed).

Using the combined output from all four Wave 1 agents:

1. **Correlate and deduplicate** — merge overlapping intelligence, resolve conflicts between agent outputs
2. **Build attack paths** — connect attack surface entries to threat actor TTPs to detection gaps, identifying the most dangerous paths (high impact + low detection coverage)
3. **Prioritize actions** — rank by risk-adjusted value (exploitability x impact x detection gap)
4. **Produce defensive recommendations** — quick wins and strategic improvements, each citing CIS Control or NIST CSF reference

---

## Final Output Format

```
## TARGET BRIEFING: {target name/description}
### Date: {current date}

### 1. ATTACK SURFACE INVENTORY
- Assets, services, technology stack (from Agent 1)
- Entry points ranked by exposure and exploitability
- Trust boundaries and data flows

### 2. THREAT PROFILE
- Threat actors and motivation (from Agent 2)
- Relevant ATT&CK techniques mapped to the target's stack
- Historical CVEs and known weakness patterns

### 3. ATTACK PATHS (Prioritized)
For each path (synthesized from Agents 1 + 2):
- ATT&CK technique chain (T-codes)
- Specific tool commands and procedures
- Prerequisites and assumptions
- Estimated difficulty and impact
- Detection likelihood (from Agent 3)

### 4. DETECTION COVERAGE MAP
- Coverage matrix: ATT&CK technique | Covered? | Data Source | Rule
- GAPS highlighted with severity
- Sigma/KQL rules for critical gaps (from Agent 3)

### 5. KNOWLEDGE GAPS
- What we don't know (from Agent 4)
- Ordered recon plan: passive first, then active
- Specific tool commands with flags
- OPSEC notes per step

### 6. PRIORITIZED ACTION PLAN
- Phase 1 (Passive): Recon commands, OSINT collection, no target interaction
- Phase 2 (Active): Enumeration, scanning, fingerprinting
- Phase 3 (Exploitation): Highest-value attack paths to attempt first
- Phase 4 (Post-Exploitation): Lateral movement, persistence, data access
- OPSEC notes for each phase

### 7. DEFENSIVE RECOMMENDATIONS
- Quick wins (implement in < 1 hour)
- Strategic improvements (requires planning)
- Detection rules to deploy immediately (full Sigma YAML)
```

Every finding must include confidence tags: [CONFIRMED], [INFERRED], [EXTERNAL], [UNCERTAIN].
Every attack technique must include its ATT&CK ID.
Every defensive recommendation must cite the relevant CIS Control or NIST CSF reference.
Be specific — tool commands with exact flags, not generic advice.

Target: $ARGUMENTS
