blue-team-detection
claudeDetection engineering and threat hunting: Sigma and YARA rules with SIEM translations, detection-as-code, and hypothesis-driven hunts mapped to MITRE ATT&CK.
2 skills · 2 commands · 2 agents
5
claude
incident-response
Security incident response: incident command and coordination, forensic evidence handling, playbooks for common incident types, and blameless postmortems.
/
Plugin incident-response from marketplace libre-secops in Ormus-Solutions/LibreSecOps-Claude-Code. Commands read from the repo's manifest — 1 month ago.
What it installs
Skills (1)
ir-playbooksStep-by-step incident response playbooks (indicators, validation, containment, eradication and recovery, post-incident) for malware infection, account compromise, data breach, ransomware, DDoS, and insider threat. Use when responding to one of these incidents or writing its runbook.
Slash commands (2)
/incident-response:incident-postmortemGenerate a blameless post-incident review from the incident timeline, actions taken, and outcomes: response metrics, root cause and contributing factors, what went well, improvements, and owned action items.
/incident-response:incident-responseActivate an incident response playbook for a reported security event and guide triage, containment, eradication, recovery, and evidence preservation.
Subagents (2)
forensic-analystUse this agent when evidence has to be collected, preserved, or analyzed during a security incident: order of volatility, memory and disk acquisition, log and network timelines, cloud audit trails, and chain of custody. It guides forensically sound collection and produces a timeline and IOCs; for co
incident-commanderUse this agent when a security incident is active or suspected and the response needs coordination: severity classification, role assignment, containment decisions, stakeholder and regulatory communication, and escalation. It runs the NIST SP 800-61 lifecycle from detection through recovery and keep
More from Ormus-Solutions/LibreSecOps-Claude-Code
All 33 plugins →bug-bounty-methodology
claudeMethodology for authorized bug bounty programs: scope-respecting reconnaissance, attack surface mapping, and vulnerability reports that triagers can reproduce.
2 skills · 2 commands · 2 agents
5
compliance-frameworks
claudeCompliance assessment, gap analysis, and audit evidence planning for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, and NIST frameworks.
2 skills · 2 commands · 2 agents
5
container-security
claudeContainer security for Docker and Podman: Dockerfile and Compose hardening, image vulnerability scanning with SBOMs, and runtime isolation.
2 skills · 2 commands · 2 agents
5
devsecops-pipelines
claudeSecurity-integrated CI/CD: pipeline security architecture, SAST, SCA, secrets, IaC, and container scanning in GitHub Actions, GitLab CI, and Jenkins, and build-breaking security gates.
2 skills · 2 commands · 2 agents
5
forensics-analysis
claudeDigital forensics for authorized investigations: investigation planning, chain of custody, disk and artifact analysis, timelines, and memory forensics with Volatility.
2 skills · 2 commands · 2 agents
5
Similar plugins
incident-io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/claude-plugins-official 47,076
cybersecurity-skills
claude818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.
200 skills
mukul975/Anthropic-Cybersecurity-Skills 36,021
incident.io
claudecodexWork with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).
11 skills · 1 MCP server
anthropics/knowledge-work-plugins 35,601
45 advanced engineering skills: agent designer, agent workflow designer, RAG architect, database designer + schema designer + SQL assistant, migration architect, observability designer, dependency auditor, changelog generator, API design reviewer, API test suite builder, CI/CD pipeline builder, MCP server builder, skill security auditor, skill tester, performance profiler, focused-fix, browser-automation, full-page-screenshot, git-worktree-manager, monorepo-navigator, codebase-onboarding, interview-system-designer, runbook-generator, spec-driven-workflow, secrets-vault-manager, env-secrets-manager, pr-review-expert, self-eval, tc-tracker, feature-flags-architect, kubernetes-operator, chaos-engineering, ship-gate, slo-architect (error-budget + multi-window burn-rate alerts per Google SRE Workbook), tech-debt-tracker, agent-regression-evals, coding-agent-rollout, commit-craft, agent-run-forensics and i18n-localization. Agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw.
48 skills · hooks
alirezarezvani/claude-skills 29,725
kubeshark
claudeNetwork observability skills powered by Kubeshark MCP — root cause analysis, KFL traffic filtering, snapshot forensics, PCAP extraction.
4 skills · 1 MCP server
kubeshark/kubeshark 12,137
Commercial Legal
claudeReviews vendor agreements, NDAs, and SaaS subscriptions against your sales-side or purchasing-side playbook, tracks renewals and cancel-by deadlines before they're missed, routes escalations to the right approver, and translates reviews into summaries business stakeholders will actually read.
12 skills · 3 agents · 7 MCP servers
anthropics/claude-for-legal 9,991
Maintain incident-response?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.
claude & codex plugins33 plugins