adef

Plugin adef from marketplace adef-marketplace in Nebulock-Inc/agentic-detection-engineering-framework. Commands read from the repo's manifest — 29 days ago.

Skills (9)

• catalog-onboarding

  Onboard a detection-rule repository into the ADEF catalog. Use when the user wants to catalog a rules repo, when `adef catalog` leaves files unrecognized or needs_review, or when a repo contains a custom/in-house rule format ADEF doesn't parse yet. Drafts extraction profiles for unknown formats via

• catalog-sync

  Keep the ADEF catalog current after the source rules repo changes, using `adef sync`. Use when the user says their rules repo changed and the catalog needs refreshing, asks to reconcile / re-sync / "what's new, modified, or orphaned since we catalogued", wants a CI staleness check, or asks why the c

• coverage-review

  Assess MITRE ATT&CK coverage from the ADEF catalog (read-only) and turn it into a work plan. Use when the user asks how good their detection coverage is, where the gaps or blind spots are, which techniques are single points of failure or ride one log source, what to build or tune next, or wants a sh

• detection-author

  Author a new detection rule with the detection engineer, grounded in their declared schema and existing catalog. Use when the user wants to write a new detection, create a rule from a threat report or hunt finding, or "help me build a detection for X". Interviews the engineer for the context an AI c

• detection-explorer

  Browse and inspect the ADEF detection catalog (read-only). Use when the user asks which detections exist or wants to find/filter them (by platform, ATT&CK tactic, engine, status, stage, origin, or review state), asks what needs MITRE tagging or review, or wants one detection's record, query, tactics

• forge-stage

  Drive a detection through the FORGE stages after Find — Observe (baseline real telemetry, validate or kill the hypothesis), Refine (similarity/overlap/verification gates), Govern (deployment gate decision), Evolve (tune or deprecate). Use when the user advances a detection stage, runs or interprets

• health-capture

  Get real detection-health numbers into the ADEF workspace so the Evolve stage has evidence — signal volume, false/true positive counts, runtime cost, deployed-vs-catalogued drift, and telemetry-source liveness. Use when the user has metrics from their SIEM and asks how to record them, wants to know

• mitre-tagger

  Map ATT&CK techniques onto catalogued detections that have none. Use when the user wants to drain the `no_mitre` enrichment queue, add MITRE ATT&CK coverage to catalog records, or asks "which techniques does this detection cover?". Selects technique IDs grounded in the shipped ATT&CK reference (neve

• schema-declaration

  Set up or update ADEF schema declarations — the YAML listing a SIEM's data sources and their fields — from a real field export. Use when the user wants to declare data sources or build a field inventory, when `adef schema` commands report no schemas, when they ask how to set ADEF up for their SIEM (

Subagents (1)

• profile-author

  Drafts an ADEF extraction profile for a cluster of detection-rule files in an unrecognized format. Use when `adef catalog` reports unclaimed rule-shaped files and the catalog-onboarding skill has clustered them. Input - a list of file paths in one structural cluster plus optional user hints. Output

MCP servers (1)

• adef

  runs: adef-mcp

Similar plugins