claude

incident-response-dfir

Name: incident-response-dfir
Author: Matt Corbett

Blue-team DFIR / SOC team — agents (dfir-response-lead, detection-and-forensics-engineer) for running a security incident end to end: the incident lifecycle per NIST SP 800-61r3 (CSF 2.0-aligned; supersedes r2; 4 phases: preparation -> detection & analysis -> containment/eradication/recovery -> post-incident), triage & severity classification, containment strategy, breach coordination + comms + regulatory notification (GDPR 72h), tabletops; and detection engineering (SIEM/Sigma rules mapped to MITRE ATT&CK, alert tuning), hypothesis-driven threat hunting, evidence acquisition & forensics (order of volatility per RFC 3227, chain of custody), and malware triage. skills, a knowledge bank with two Mermaid decision trees + a dated 2026 DFIR tooling map, best-practices, templates, an advisory hook. Seams: appsec/secure-coding -> security-engineering; governance/risk/audit -> cybersecurity-grc; reliability incidents -> observability-sre; platform abuse -> trust-and-safety. Requires ravenclaude-core@>=0.7.0.

9 on GitHubby Matt Corbettv0.1.3MITupdated today

Plugin incident-response-dfir from marketplace ravenclaude in mcorbett51090/RavenClaude. Commands read from the repo's manifest — today.

This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.

What it installs

Skills (5)

acquire-and-preserve-evidence
Acquire and preserve digital evidence so it survives scrutiny — collect in RFC 3227 order of volatility (most-volatile first), hash at collection, maintain an unbroken chain of custody, and use the right acquisition method per source (memory, disk, network, cloud). Returns the acquisition plan, the
engineer-a-detection
Turn an observed (or hypothesized) adversary behavior into a durable detection — author a Sigma/SIEM rule, map it to the MITRE ATT&CK technique it covers, and ship a false-positive tuning plan so the rule survives contact with production logs instead of dying in alert fatigue. Returns the rule, its
hunt-for-a-threat
Run a hypothesis-driven threat hunt — turn a testable claim about adversary activity into named data sources and queries, guided by MITRE ATT&CK, and rank findings up David Bianco's pyramid of pain so effort goes at TTPs (expensive for the adversary to change) rather than hashes and IPs (trivial to
run-the-incident-lifecycle
Run a security incident through the four-phase incident-handling lifecycle in order — preparation, detection & analysis, containment/eradication/recovery, and post-incident activity — with the contain-before-eradicate and preserve-evidence-first gates enforced at the right steps. Returns a phase-by-
triage-and-classify-an-incident
Decide whether an alert or report is a genuine security incident (the is-it-an-incident gate), then classify its severity/priority from a business-impact × scope matrix so the response tier is set by impact, not by how loud the alert looks. Returns the incident verdict, the severity level + the rule

Subagents (2)

detection-and-forensics-engineer
Use for the technical DFIR surface — detection engineering (SIEM/Sigma rules mapped to MITRE ATT&CK, alert tuning), threat hunting, forensics & evidence acquisition (order of volatility, chain of custody, memory/disk/cloud), malware triage. NOT lifecycle/severity/comms -> dfir-response-lead.
dfir-response-lead
Use for running a security incident — NIST 800-61 lifecycle, triage & severity, containment strategy, eradication/recovery, breach coordination, comms, regulatory notification (GDPR 72h), tabletops, post-incident review. NOT detection/forensics/hunting -> detection-and-forensics-engineer.

Hooks (1)

PreToolUse
/usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS -u LD_PRELOAD -u LD_LIBRARY_PATH -u LD_AUDIT -u DYLD_INSERT_LIBRARIES -u DYLD_LIBRARY_PATH -u PYTHONPATH -u PYTHONSTARTUP PATH=/usr/local/bin:/

View source on GitHub mcorbett51090.github.io

More from mcorbett51090/RavenClaude

All 184 plugins →

RavenClaude Core

claude

Domain-neutral Claude Code foundation: specialist agents, skills, gates, hooks, rules, templates. Capability Grounding Protocol, Structured Output Protocol, Researcher meta-skill, comfort-posture dashboard, opt-in command-review tribunal (the Thing), WebFetch sanitizer, branch-archive escape hatch, brand-extraction (homepage → brand kit), /wireframe (describe anything → validated model + high-fi Artifact + Mermaid), Problems & Resolutions view, declarative-visualization (Vega-Lite/Deneb/SVG, Gate 101 + Gate 103 svg-report-lint, viz-spec-reviewer), and Claude orchestrator escape hatch (/claude-orchestrate). Slash commands: /init-agent-ready, /wrap, /set-posture, /dashboard, /forge, /wireframe, /reset-plugin-cache, /handoff.

70 skills · 14 commands · 18 agents · hooks

power-platform

claude

Power Platform specialist team — agents (incl. power-platform-tester, power-bi-engineer) and skills, with strong ALM/git coverage for solutions, flows, and PBIP. A house-opinions hook flags 8 §3/§4 violations; the knowledge bank carries production decision trees (PA-flow recovery, Dataverse token-acquisition, PCF React surface, PBI deploy/refresh, custom-connector build-path, PBIR Enhanced infinite-spinner debug + full build reference, DAX silent-zero scoring via the `Domain` pattern, sempy.fabric notebook reference, Power BI Copilot report-readiness, Code Apps connector gotchas, PBIP deployment variables + #839, PBIR reference enrichment, PBIP report fast-solve triage router [MCP-optional], main-forms-are-Web-API-authorable grounding) plus a real-engagement scenarios bank. Bundles the community pbix-mcp server (d0nk3yhm/pbix-mcp, MIT) for .pbix/.pbit read/write/DAX-eval (`pip install pbix-mcp`); documents (not bundles) the official Microsoft Dataverse MCP (CLAUDE.md §9a). Extends ravenclaude-core.

24 skills · 8 commands · 11 agents · 1 MCP server · hooks

finance

claude

Corporate finance & FP&A specialist team — FP&A analyst (budgets, forecasts, variance commentary), financial modeler (3-statement, DCF, scenarios), controller (close, JEs, reconciliations), treasury analyst (cash, covenants, FX), valuation analyst (DCF + comps + precedent), audit-prep specialist (PBC, walkthroughs, SOC1/2 narratives), and board-pack composer. skills incl. a gold-standard NetSuite close (OAuth2 M2M + SuiteQL BS/IS trial balance, layperson runbook), templates, a knowledge bank (ASC 805 / 718 / 740, accrual-cutoff, WACC, cost accounting, FP&A operating model + decision support, NetSuite integration landscape), advisory hooks (hardcoded rates / plaintext PII / missing Sources / Assumptions; secrets-PII scan). Inherits ravenclaude-core protocols.

23 skills · 7 commands · 7 agents · hooks

web-design

claude

Web design & build specialist team — web architect (IA, stack, hosting), UX designer (wireframes, flows, conversion), visual designer (brand, typography, tokens), frontend implementer (HTML/CSS/JS, React, Astro, Next), content strategist (copy, microcopy, SEO content), accessibility auditor (WCAG 2.2 AA/AAA), and performance engineer (Core Web Vitals, image/font optimization). skills (the gold-standard-website-pipeline gated build pipeline, static-site build, design-system audit, card/tile UI, accessibility review, Core Web Vitals tuning, technical SEO audit, information architecture, conversion design, content audit, design-tokens scaffolding, third-party hygiene, Fluent UI v9 + React implementation), templates, an advisory hook, and a knowledge bank seeded with a curated 2026 reference set of "cutting edge yet simple" marketing-site donors — the design agents carry compact inline priors plus a pointer to the full brief. Inherits ravenclaude-core protocols.

19 skills · 7 commands · 7 agents · hooks · LSP

edtech-partner-success

claude

EdTech-flavored Partner Success Manager team — specialist agents anchored on the PSM lane, with skills, templates, an advisory hook, a knowledge bank with Mermaid decision trees, a engagement bank, and a stdlib psm_calc.py calculator (seat-utilization / renewal-NRR-forecast / time-to-value). Covers QBRs, success plans, health scores, a self-contained Power-BI-style partner-health report, onboarding, touchpoint logs, adoption sequencing, 90-day implementation arcs, train-the-trainer curricula, advocacy/reference pipelines, renewal decision memos, and the integration contract for a centralized CS dashboard (Planhat + Salesforce + Snowflake + Zapier + Granola). Team growth ships as skills + knowledge + templates, not parallel agents. Primary-source citations with retrieval dates. Vertical-explicit but segment-agnostic — fits K-12, higher-ed, corporate L&D, or mixed EdTech books. Inherits ravenclaude-core protocols including the alternate-methods Capability Grounding Protocol.

17 skills · 5 commands · 6 agents · hooks

regulatory-compliance

claude

Financial-regulatory & compliance specialist team — function agents (AML/KYC, regulatory-reporting, risk-and-controls, policy & procedure, examination-prep, Bermuda-insurance) PLUS jurisdiction/regulator specialists: BMA financial-institutions (banking, trust, corporate-services, fund-admin, investment-business, money-service, digital-assets — the primary build-out, with deep AML/ATF + supervision/fees + licensing-classification trees), CIMA (Cayman), Bahamas, Channel Islands (Jersey JFSC + Guernsey GFSC), UK PRA, and US federal+state. primary-source-cited regulator knowledge files, best-practice rules, skills, templates, a defensive PreToolUse hook (PII scrub — SSN/IBAN/credit-card/Bermuda TIN/wire instructions). Positioning reflects field experience inside a Tier-1 financial regulator (BMA). Inherits ravenclaude-core protocols.

11 skills · 5 commands · 12 agents · hooks

Similar plugins

incident-io

claudecodex

Work with incident.io from Claude: respond to and investigate incidents, check on-call schedules and escalations, and author the runbooks, skills and architecture docs that incident.io investigations draw on. Bundles the official incident.io MCP server (OAuth on first use).

11 skills · 1 MCP server

anthropics/claude-plugins-official 47,076

cybersecurity-skills

claude

818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.

200 skills

mukul975/Anthropic-Cybersecurity-Skills 36,021

incident.io

claudecodex

11 skills · 1 MCP server

anthropics/knowledge-work-plugins 35,601

engineering-skills

claude

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security, incident-response, red-team, threat-detection. v2.8.1 audits senior-fullstack / senior-frontend / senior-backend against karpathy-coder + Matt Pocock — each ships a 7-question forcing-question library, 4 customization profiles (JSON), deterministic decision engine, composition map into POWERFUL specialists, plus cs-fullstack-engineer / cs-frontend-engineer / cs-backend-engineer orchestrator agents (context: fork) + /cs-fullstack-review, /cs-frontend-review, /cs-backend-review, /cs-engineer-grill slash commands.

35 skills · hooks

alirezarezvani/claude-skills 29,725

pharon

claude

Pharon, the warning light for your stack: keeps a local inventory of your packages, runtimes, container images, CI actions and services, and alerts your team when a compromised release, an exploited vulnerability, a vendor breach or an end-of-life date reaches it. Scans run on your machine and only the inventory is uploaded, after you approve the first upload in /pharon:setup. Needs a Pharon account; a 7-day free trial is available.

4 skills · hooks

davepoon/buildwithclaude 3,741

security

claudecodex

Threat modeling, security architecture review, incident response, vulnerability management, and access and identity. Reviewer-class.

8 skills

cbrock84/headcount 2,573

Maintain incident-response-dfir?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins184 plugins