SecOps Skills

Plugin secops-skills from marketplace secops-claude-skills in ftrout/secops-claude-skills. Commands read from the repo's manifest — 1 month ago.

Skills (16)

• cloud-incident-investigation

  Investigate suspected compromise in AWS, Azure, or GCP: find the right logs (CloudTrail, AzureActivity, Entra audit, GCP Cloud Audit Logs), reconstruct what an identity or access key did, spot the high-signal control-plane events (access key creation, role assumption chains, StopLogging, PutBucketPo

• detection-engineering

  Design, write, test, tune, deploy, and review detection rules through their full lifecycle, with Sigma as the canonical rule format and conversion to Splunk SPL, Sentinel/Defender KQL, Elastic EQL/ES|QL, or Chronicle YARA-L. Use it whenever someone wants to "write a detection", "build a rule for", "

• identity-threat-investigation

  Investigate a suspected account or identity compromise in Entra ID (Azure AD), Okta, Google Workspace, or on-prem Active Directory: analyze sign-in logs for impossible travel, new country or ASN, MFA fatigue, legacy auth, token replay and AiTM session hijack; check risky OAuth consent grants, MFA me

• incident-report-writing

  Write incident communications for the right audience: executive summaries, technical post-incident reports, status updates on a cadence during a live incident, customer and partner notification drafts, regulatory notification checklists (GDPR, SEC 8-K, HIPAA, NIS2, DORA, state laws), and blameless l

• incident-triage

  Triage a security alert or suspicious event the way a tier-1/tier-2 SOC analyst does: decide whether it is a true positive, benign, or a false positive, scope it, assign a defensible severity tier, and write a triage note with evidence for and against, actions taken, and next steps. Use this wheneve

• ioc-extraction

  Extract, normalize, defang/refang, classify, and de-duplicate indicators of compromise (IPs, domains, URLs, hashes, emails, file paths, registry keys, CVEs, wallet addresses) from any unstructured text such as threat intel reports, vendor advisories, phishing emails, pasted logs, PDFs, or chat messa

• log-forensics

  Investigate an incident from logs: pick the Windows Security/System/PowerShell/Sysmon event IDs, Linux auth/audit/systemd/cron/shell-history artifacts, and web server or proxy logs that answer the question, normalize time zones, merge everything into one UTC super-timeline, pivot user to host to pro

• malware-triage

  Safe static triage of a suspicious file, hash, or sandbox report without ever executing it: hash lookups, file type by magic, entropy and packing indicators, PE/ELF/LNK/PDF/Office/archive metadata, interesting strings and IOCs, sandbox report interpretation (Tria.ge, ANY.RUN, VMRay, Hybrid Analysis,

• mitre-attack-mapping

  Map observed adversary behaviour to MITRE ATT&CK tactics, techniques and sub-techniques with evidence, rationale, and confidence, then produce a mapping table and an ATT&CK Navigator layer JSON. Use it whenever someone asks "what ATT&CK techniques is this", "map this to ATT&CK", "tag this with TTPs"

• phishing-analysis

  Analyze a reported or suspicious email end to end: Received chain and SPF/DKIM/DMARC alignment, sender and Reply-To and display-name mismatches, lookalike domains, URL and redirector analysis, QR codes, HTML smuggling, attachment triage, lure classification (BEC/invoice, credential harvest, callback

• purple-team-exercise

  Plan and run a purple-team detection-validation exercise: a controlled, cooperative test of whether your telemetry and detections would see a chosen set of adversary behaviors, not an attack. Use it to turn a threat profile or an incident into scenarios, pick ATT&CK techniques, map each to public ad

• siem-query-authoring

  Turn an investigative question, a hunt hypothesis, or an indicator list into a correct, efficient query for the team's SIEM: Microsoft Sentinel / Defender XDR (KQL), Splunk (SPL with CIM), Elastic (KQL, EQL, ES|QL over ECS), Google SecOps / Chronicle (UDM search, YARA-L), or Athena / BigQuery SQL ov

• soar-playbook-design

  Design safe security automation playbooks for a SOAR platform (Microsoft Sentinel automation rules and Logic Apps, Splunk SOAR, Cortex XSOAR, Tines, Shuffle): triggers, enrichment, decision logic, containment behind human-approval gates, idempotency, rate limits, rollback, error handling, dry-run te

• threat-hunting

  Plan, run, and write up hypothesis-driven threat hunts (PEAK / TaHiTI style): turn a threat report, an ATT&CK technique, a coverage gap, an anomaly, or "something feels off" into a testable hypothesis with data sources, queries, expected benign volume, an analysis technique (stacking, prevalence, ba

• threat-intel-analysis

  Turn raw threat intelligence (vendor reports, ISAC bulletins, CISA/CERT advisories, STIX bundles, MISP events, social-media threads, leak-site posts, dark-web chatter) into actionable products: extract TTPs and indicators, grade the source with the Admiralty code, assess relevance against the organi

• vulnerability-triage

  Prioritise vulnerabilities and produce a ranked remediation plan using CVSS v3.1/v4.0, EPSS, CISA KEV, exploit maturity, asset exposure and criticality, compensating controls, and business context, with tiers (P1..P4), SLAs, risk statements, and asset-owner communications. Use it whenever someone sh

Similar plugins