lmiranda
747a2b15e5
- Extract 9 skill files from command knowledge: - mcp-tools-reference.md: Complete NetBox MCP tools reference - system-discovery.md: Bash commands for system info gathering - device-registration.md: Device registration workflow - sync-workflow.md: Machine sync process - audit-workflow.md: Data quality audit checks - ip-management.md: IP/prefix management and conflict detection - topology-generation.md: Mermaid diagram generation - change-audit.md: NetBox change audit workflow - visual-header.md: Standard visual header pattern - Slim all 11 commands to under 60 lines: - cmdb-sync.md: 348 -> 57 lines - cmdb-register.md: 334 -> 51 lines - ip-conflicts.md: 238 -> 58 lines - cmdb-audit.md: 207 -> 58 lines - cmdb-topology.md: 194 -> 54 lines - initial-setup.md: 176 -> 74 lines - change-audit.md: 175 -> 57 lines - cmdb-site.md: 68 -> 50 lines - cmdb-ip.md: 65 -> 52 lines - cmdb-device.md: 64 -> 55 lines - cmdb-search.md: 46 lines (unchanged) - Update agent to reference skills for best practices - Preserve existing netbox-patterns skill Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
58 lines
1.4 KiB
Markdown
58 lines
1.4 KiB
Markdown
---
|
|
description: Audit NetBox changes with filtering by date, user, or object type
|
|
---
|
|
|
|
# CMDB Change Audit
|
|
|
|
Query and analyze the NetBox audit log for change tracking and compliance.
|
|
|
|
## Skills to Load
|
|
|
|
- `skills/visual-header.md`
|
|
- `skills/change-audit.md`
|
|
- `skills/mcp-tools-reference.md`
|
|
|
|
## Usage
|
|
|
|
```
|
|
/change-audit [filters]
|
|
```
|
|
|
|
**Filters:**
|
|
- `last <N> days/hours` - Changes within time period
|
|
- `by <username>` - Changes by specific user
|
|
- `type <object-type>` - Changes to specific object type
|
|
- `action <create|update|delete>` - Filter by action type
|
|
- `object <name>` - Search for changes to specific object
|
|
|
|
## Instructions
|
|
|
|
Execute `skills/visual-header.md` with context "Change Audit".
|
|
|
|
Execute `skills/change-audit.md` which covers:
|
|
1. Parse user request for filters
|
|
2. Query object changes via MCP
|
|
3. Enrich data with detailed records
|
|
4. Analyze patterns
|
|
5. Generate report
|
|
|
|
## Security Audit Mode
|
|
|
|
If user asks for "security audit" or "compliance report":
|
|
- Focus on deletions and permission-sensitive changes
|
|
- Highlight changes to critical objects (firewalls, VRFs, prefixes)
|
|
- Flag changes outside business hours
|
|
- Identify users with high change counts
|
|
|
|
## Examples
|
|
|
|
- `/change-audit` - Recent changes (last 24 hours)
|
|
- `/change-audit last 7 days` - Past week
|
|
- `/change-audit by admin` - All changes by admin
|
|
- `/change-audit type dcim.device` - Device changes only
|
|
- `/change-audit action delete` - All deletions
|
|
|
|
## User Request
|
|
|
|
$ARGUMENTS
|