blue-team-detection
claudeDetection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.
2 skills · 2 commands · 2 agents
4
claude
siem-log-management
SIEM and log management: SIEM architecture and log source planning, detection and hunting queries in Splunk SPL, Elastic KQL/EQL, and Sentinel KQL, and cross-source event correlation.
/
Plugin siem-log-management from marketplace libre-secops in HermeticOrmus/LibreSecOps-Claude-Code. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (2)
log-correlation-patternsPatterns for correlating events across log sources to detect multi-stage attacks, lateral movement, credential abuse, and data exfiltration, including alert-on-alert, threshold anomaly, and kill chain correlation. Use when designing correlation rules or investigating activity that spans several syst
siem-query-languagesReference for Splunk SPL, Elastic KQL/EQL, and Microsoft Sentinel KQL with security query examples, a cross-platform conversion cheat sheet, Sigma for write-once rules, and query performance tips. Use when writing or translating SIEM queries.
Slash commands (2)
/siem-log-management:log-queryBuild a detection, investigation, or threat hunting query for a threat or scenario in Splunk SPL, Elastic KQL/EQL, Microsoft Sentinel KQL, or Sigma, with tuning notes for false positives.
/siem-log-management:siem-setupDesign a SIEM architecture for an environment: log source priorities, collection strategy, retention policy, and an initial detection rule set.
Subagents (2)
log-analystUse this agent when writing or tuning a detection or investigation query in Splunk SPL, Elastic KQL/EQL, or Sentinel KQL, converting a Sigma rule, or triaging alerts and rebuilding an incident timeline. It works from MITRE ATT&CK and sources such as Windows Security events, Sysmon, auditd, and Cloud
siem-architectUse this agent when deploying, migrating, or redesigning a SIEM such as Splunk, Elastic Security, Microsoft Sentinel, Google Chronicle, or QRadar. It prioritizes log sources by detection value, designs collection, parsing, and normalization (CIM, ECS, ASIM), sizes capacity and retention tiers, and p
More from HermeticOrmus/LibreSecOps-Claude-Code
All 33 plugins →bug-bounty-methodology
claudeMethodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.
2 skills · 2 commands · 2 agents
4
compliance-frameworks
claudeCompliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.
2 skills · 2 commands · 2 agents
4
container-security
claudeContainer security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.
2 skills · 2 commands · 2 agents
4
devsecops-pipelines
claudeSecurity-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.
2 skills · 2 commands · 2 agents
4
forensics-analysis
claudeDigital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.
2 skills · 2 commands · 2 agents
4
Similar plugins
crowdstrike-falcon-fusion
claudecodexCrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import and release, execution monitoring, and Falcon Next-Gen SIEM lookup files.
7 skills · hooks
anthropics/claude-plugins-official 47,076
CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import and release, execution monitoring, and Falcon Next-Gen SIEM lookup files.
7 skills · hooks
openai/plugins 7,914
log-aggregation-setup
claudeSet up log aggregation (ELK, Loki, Splunk)
1 skill · 1 command
jeremylongshore/tons-of-skills-marketplace 2,917
elastic-elasticsearch
claudeElasticsearch skills — ES|QL queries, data ingestion, security (authn, authz, audit), and troubleshooting
10 skills
elastic/agent-skills 605
security-skills
claudeSecurity architecture, compliance frameworks, vulnerability management, TLS, firewalls, and SIEM
76 skills
ancoleman/ai-design-components 531
cybersecurity-skills
claudeCybersecurity skills for AI coding agents: OWASP source-code audit, dependency CVE triage, cloud / IAM / container hardening, recon, OSINT, incident triage, disk forensics, SIEM detection engineering, prompt-injection audit, API security, web pentest, threat modeling, mobile / crypto / secrets audit
42 skills · 1 agent
briiirussell/cybersecurity-skills 517
Maintain siem-log-management?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins33 plugins