---
name: system_runbook_graph_generator
description: Use when asked to turn an existing Cerebra runbook card, an approved runbook draft, or an analyser-produced graph brief into a CyberViewer graph preview or official runbook graph.
owner-feature: cyberviewer
primary-job: Turn one structured runbook card or graph brief into one CyberViewer graph.
allowed-tools:
  - mcp__cerebra__toolkit_state_get
  - mcp__cerebra__runbooks_list
  - mcp__cerebra__runbook_get
  - mcp__cerebra__runbook_get_graph
  - mcp__cerebra__runbook_save_graph
  - mcp__cerebra__graph_preview_show
  - mcp__cerebra__graph_preview_get
  - Read
  - Grep
  - Glob
---

# Mission

Generate or refine one CyberViewer graph for one already-structured Cerebra technique or runbook card.

This skill only works inside a Cerebra AI session with the Cerebra MCP server available. If those MCP tools are unavailable, say that this skill only works inside Cerebra and stop. Do not fall back to repo authoring workflows.

Do not treat raw terminal history, browser evidence, or loose operator notes as sufficient graph input by themselves. If the request starts from raw live evidence and there is not already:

- an existing official runbook card, or
- a current draft contract from `system_runbook_analyser`, especially a `graphBrief`

then stop and use `system_runbook_analyser` first.

Use the packaged local references in this skill as the authoritative graph schema and generation guidance:

- `resources/scenario.d.ts`
- `resources/Icon-Catalog.md`
- `resources/JSON-Generation-Rules.md`
- `resources/Mitre-reference.md`
- `examples/example-minimal.json`
- `examples/example1.json`
- `examples/example2.json`
- `examples/example3.json`

Icon handling is strict:

- In Scenario JSON, `entity.icon` must be an exact `IconKey` from `resources/scenario.d.ts`.
- Those keys are logical registry names like `IconAWS` or `IconFortiGate`, not asset filenames like `aws.svg` or `FortiGate.svg`.
- Do not emit `iconPath` in graph JSON.
- If no exact icon key is clearly justified, omit `icon` instead of inventing one.

## Workflow

1. Resolve the structured source:
   - an official runbook card from `runbook_get`, or
   - a draft runbook card and `graphBrief` already produced by `system_runbook_analyser` in the current conversation
2. If that structured source does not exist yet, stop and use `system_runbook_analyser` first.
3. Use the local schema and examples to produce one valid Scenario JSON object for Cerebra CyberViewer from the structured source, not from raw session noise.
   Prefer the compact style shown in `examples/example-minimal.json` unless the technique genuinely needs more structure.
   Validate every non-empty `entity.icon` against `resources/scenario.d.ts` before finalizing.
4. For visualization, preview, or "show me the graph" requests, call `graph_preview_show` and stop at preview mode unless the user explicitly asks for official runbook persistence.
5. Use `runbook_save_graph` only when the user explicitly asked to persist the graph into a specific official runbook.

## Graph Scope

- Focus on one runbook card at a time and model the main actors, systems, tools, artifacts, and step-to-step data flow.
- Default to a compact operational graph. Most preview graphs should stay small unless the user explicitly asks for a fuller topology.
- Add logical containers only when they improve readability.
- If the graph includes a known host plus internal service, listener, session, process, or artifact nodes that belong to that host, the host must be represented as a container containing those child nodes.
- Do not leave service, listener, session, process, or artifact nodes floating outside a host container when their parent host is known.
- Use accurate MITRE annotations when the technique maps cleanly.
- Prefer an operational graph that explains the technique over a decorative graph that mirrors every sentence in the description.
- Only include steps, entities, and intermediate artifacts that were directly observed in the structured source or explicitly requested by the user.
- Do not model the Cerebra user, analyst, or generic `operator` actor just because the evidence came from interactive terminal sessions.
- Do not add SSH setup edges, pane-opening steps, or host-control choreography unless SSH or remote administration is itself the technique being documented.
- When the evidence came from known Cerebra hosts, keep host naming grounded in those real host identities instead of inventing dramatic aliases.
- For compact reverse-shell graphs, default to the actual source host, the listener or C2 endpoint, the callback/shell artifact, and the resulting access. Usually that does not require a separate human operator node.

## Persistence Rules

- Preview-first is the default for graph generation requests inside the AI panel unless the user explicitly asks to save into a runbook.
- Use `graph_preview_get` when the user approved a preview and wants to promote that same graph into an official runbook.
- Prefer the analysed `graphBrief` and runbook draft structure over improvising topology from raw evidence.
- Do not save a graph without a concrete `profileName` and `commandId`.
- Do not modify the runbook card itself from this skill.
- If an existing graph already captures the technique well, refine it instead of replacing it gratuitously.
- If the evidence is too thin for a defensible graph, say so rather than inventing topology.

## Completion Check

- The graph matches the current runbook card and evidence.
- The graph was generated from an existing runbook card or analyser-produced structured draft, not directly from raw evidence alone.
- The JSON is valid against the packaged schema and rules.
- Every explicit `entity.icon` value is a real `IconKey`, or the icon field was omitted when uncertain.
- Known hosts with child service/session/process nodes are represented as host containers, not as flat peers.
- No floating service, listener, or session nodes remain when their parent host is known.
- A preview was shown with `graph_preview_show` unless the user explicitly requested official persistence.
- An official save only happened when the user explicitly requested persistence into a runbook.
