blue-team-detection
claudeDetection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.
2 skills · 2 commands · 2 agents
4
claude
security-automation
Security orchestration, automation, and response (SOAR): platform selection, playbook design, and working automation for alert enrichment, phishing triage, and containment with human approval gates.
/
Plugin security-automation from marketplace libre-secops in HermeticOrmus/LibreSecOps-Claude-Code. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (2)
automated-responseAutomated remediation and containment patterns (endpoint isolation, IOC blocking with allowlists and expiry, alert correlation, threat intelligence feed updates) and a framework for deciding when an action can run automatically and when it needs human approval. Use when designing response playbooks
soar-patternsSOAR playbook design patterns, orchestration architecture components, a platform comparison, and integration strategies, including alert enrichment, phishing response, and automated severity scoring playbooks. Use when designing or reviewing security orchestration workflows.
Slash commands (1)
/security-automation:security-automateAnalyze a manual security workflow and design an automated playbook for it, with implementation code, approval gates, a test plan, and monitoring.
Subagents (2)
automation-builderUse this agent when a security automation design needs to become working code: SOAR playbooks (Shuffle, Tines, Splunk SOAR, XSOAR) or Python and bash scripts calling tool APIs such as VirusTotal, CrowdStrike, Okta, or Jira. It implements and tests playbooks with retries, error handling, and secure c
soar-architectUse this agent when choosing a SOAR platform, deciding which security workflows to automate, or designing the orchestration that connects SIEM, EDR, email security, identity, and ticketing tools. It produces the automation strategy, playbook designs with human approval gates, enrichment flows, and M
More from HermeticOrmus/LibreSecOps-Claude-Code
All 33 plugins →bug-bounty-methodology
claudeMethodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.
2 skills · 2 commands · 2 agents
4
compliance-frameworks
claudeCompliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.
2 skills · 2 commands · 2 agents
4
container-security
claudeContainer security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.
2 skills · 2 commands · 2 agents
4
devsecops-pipelines
claudeSecurity-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.
2 skills · 2 commands · 2 agents
4
forensics-analysis
claudeDigital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.
2 skills · 2 commands · 2 agents
4
Similar plugins
incident-io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/claude-plugins-official 47,076
cybersecurity-skills
claude818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.
200 skills
mukul975/Anthropic-Cybersecurity-Skills 36,021
incident.io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/knowledge-work-plugins 35,601
engineering-skills
claude32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security, incident-response, red-team, threat-detection. v2.8.1 audits senior-fullstack / senior-frontend / senior-backend against karpathy-coder + Matt Pocock — each ships a 7-question forcing-question library, 4 customization profiles (JSON), deterministic decision engine, composition map into POWERFUL specialists, plus cs-fullstack-engineer / cs-frontend-engineer / cs-backend-engineer orchestrator agents (context: fork) + /cs-fullstack-review, /cs-frontend-review, /cs-backend-review, /cs-engineer-grill slash commands.
35 skills · hooks
alirezarezvani/claude-skills 29,725
Commercial Legal
claudeReviews vendor agreements, NDAs, and SaaS subscriptions against your sales-side or purchasing-side playbook, tracks renewals and cancel-by deadlines before they're missed, routes escalations to the right approver, and translates reviews into summaries business stakeholders will actually read.
12 skills · 3 agents · 7 MCP servers
anthropics/claude-for-legal 9,991
Plan a VP or CPO 30-60-90 day diagnostic onboarding path.
1 skill
deanpeters/Product-Manager-Skills 8,001
Maintain security-automation?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins33 plugins