claude

dfir

Digital forensics & incident response: drive the IR lifecycle (NIST 800-61 / PICERL), forensic evidence triage and timelining, and IOC development.

11 on GitHubby Jassicsv0.1.0GPL-3.0updated 3 months agodomain
/

Plugin dfir from marketplace awesome-claude-security in jassics/awesome-claude-security. Commands read from the repo's manifest — 1 month ago.

What it installs

Skills (3)

  • forensic-triage

    Perform forensic triage on a host or artifacts — collect and analyze disk, memory, and log evidence with proper handling, then build an incident timeline. Use to investigate a compromised system or scope an incident. Preserve evidence integrity.

  • incident-response

    Drive a security incident through the response lifecycle (NIST SP 800-61 / SANS PICERL): triage and scope, contain, eradicate, recover, and capture lessons learned. Use to coordinate or work an active incident. Authorized responders only.

  • ioc-development

    Extract and operationalize indicators (IOCs) and behaviors (IOAs) from an incident or sample — atomic, computed, and behavioral — and prepare them for detection, blocking, and intel sharing. Use after/within an investigation to turn findings into defensive value.

View source on GitHub jassics.github.io

More from jassics/awesome-claude-security

All 45 plugins →

ai-safety

claude

AI safety (distinct from security): harm modeling, safety evaluations, responsible red-teaming, bias/fairness, guardrail review, and responsible-AI governance.

6 skills · 1 agent

11

Security for autonomous, tool-using AI agents: review, tool-permission audit, and autonomy-boundary testing for excessive agency.

6 skills

11

CISO executive toolkit: security strategy & roadmap, cyber-risk quantification, and board/executive decks. Auto-installs reporting, diagramming, and threat-modeling.

3 skills · 1 command · 1 agent

11

grc

claude

Governance, risk & compliance: framework gap-assessments (SOC 2 / ISO 27001 / PCI / HIPAA / GDPR / NIST), security risk assessment & register, and policy management. Auto-installs reporting + diagramming.

3 skills · 1 command · 1 agent

11

Security architect role bundle: secure-by-design architecture and design review, threat modeling, control selection, and trust-boundary analysis. Auto-installs its core stack.

3 skills · 1 command · 1 agent

11

Attack trees, threat-model DFDs, architecture diagrams, mindmaps, and infographics for security work (Excalidraw-based).

5 skills

11

Similar plugins

Matt Pocock's agent skills for real engineering (grilling, spec/ticket flows, TDD, code review, domain modelling and more).

39 skills

mattpocock/skills 323,108

ruflo-ddd

claudecodex

Domain-Driven Design scaffolding — bounded contexts, aggregate roots, domain events, and anti-corruption layers

3 skills · 1 command · 1 agent

ruvnet/ruflo 81,589

Install the "Architecture & Domain Modeling" editorial skill bundle for Claude Code.

13 skills

sickn33/agentic-awesome-skills 49,620

Connect Claude Code directly to your CockroachDB clusters for hands-on database work — explore schemas, write optimized SQL, debug queries, and manage distributed database clusters. This plugin provides 14 tools across two active MCP backends (self-hosted MCP Toolbox and managed CockroachDB Cloud MCP Server), three specialized agents (DBA, Developer, Operator), 32 skills across 6 operational domains, and built-in safety hooks.

34 skills · 3 agents · 3 MCP servers · hooks

anthropics/claude-plugins-official 47,076

818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.

200 skills

mukul975/Anthropic-Cybersecurity-Skills 36,021

incident.io

claudecodex

Work with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).

11 skills · 1 MCP server

anthropics/knowledge-work-plugins 35,601

Maintain dfir?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins45 plugins