create-sigma-ruleTurns a threat report, a malware analysis, vendor tool documentation, or a raw log sample into draft Sigma detection rules, validated against sigma-cli where a shell exists and labelled "not machine-validated" where not, each paired with a validation note covering assumptions, false positives, evasi
cti-risk-reduction-reportRates a threat against the OWASP Risk Rating Methodology, then rates it again counting only the mitigations that are implemented and verified, and again counting dated commitments, and shows the three states side by side with a financial exposure band sized to the organization. Use this skill whenev
intelligence-requirements-builderTurns a vague, high-level stakeholder ask into a structured set of intelligence requirements for a CTI team, complete with Essential Elements of Information, collection guidance, success criteria, deliverables, and a criticality rating, producing the intelligence requirements set as markdown, as a W
map-attack-techniquesMaps a threat report's narrative behaviour to current MITRE ATT&CK Enterprise and ICS techniques, with verbatim evidence, occurrence status and confidence for every mapping, after offering recommended defaults or a few setup questions; outputs markdown, Word, one Navigator layer per ATT&CK domain, a
track-cyberattackTakes a named cyberattack or campaign (a breach, intrusion campaign, supply-chain compromise, threat actor or law enforcement action) and turns it into an attack tracker dashboard in Claude, with a Word report, a Word executive brief, a STIX 2.1 bundle and ATT&CK Navigator layers, plus a standalone