Claude Skills by dandye

github.com/dandye

32 skillsA× 320 installs70 views

Full Alert TriageAComplete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.securitygitperformanceVotes: 0GitHub stars: 124
Full InvestigationAComplete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.securitygosecurityVotes: 0GitHub stars: 124
Analyze Content GapsAIdentify content gaps and organizational opportunities. Analyzes missing content areas, redundancies, and consolidation opportunities.businessgodocumentationVotes: 0GitHub stars: 124
Audit ContentAComprehensive content quality and maintenance assessment. Evaluates documentation quality, relevance, maintenance needs, and provides actionable recommendations.documentationgodocumentationVotes: 0GitHub stars: 124
Check DuplicatesACheck for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASE_ID and returns list of similar cases.businessVotes: 0GitHub stars: 124
Close Case ArtifactAClose a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.documentationgitdocumentationVotes: 0GitHub stars: 124
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
Confirm ActionAAsk the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response.businessVotes: 0GitHub stars: 124
Correlate IocACheck for existing SIEM alerts and case management entries related to IOCs. Use to understand if an indicator has triggered previous alerts or is part of ongoing investigations. Takes IOC list and returns related alerts and cases.businessgosecurityVotes: 0GitHub stars: 124
Deep Dive IocAPerform exhaustive analysis of a critical IOC. Use when an IOC needs Tier 2+ investigation beyond basic enrichment - includes GTI pivoting, deep SIEM searches, correlation with related entities, and threat attribution. For escalated IOCs requiring comprehensive investigation.securitysecuritydocumentationVotes: 0GitHub stars: 124
Design Metadata SchemaADesign comprehensive metadata frameworks. Develops structured metadata templates and tagging systems.businessVotes: 0GitHub stars: 124
Document In CaseAAdd a comment to a case to document findings, actions, or recommendations. Use to maintain audit trail during investigations. Requires CASE_ID and comment text.securityapiVotes: 0GitHub stars: 124
Enrich IocAEnrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.toolsgoVotes: 0GitHub stars: 124
Find Relevant CaseASearch for existing cases related to specific indicators or entities. Use to find correlation with other investigations before starting new analysis. Takes search terms and returns matching case IDs.businessVotes: 0GitHub stars: 124
Generate ReportASave investigation findings to a markdown report file. Use after completing triage, enrichment, or investigation to create a permanent record. Generates timestamped files in ./reports/ directory.toolsVotes: 0GitHub stars: 124
Generate SitemapAGenerate hierarchical site structure and navigation maps. Creates visual representations of information architecture and content relationships.documentationnodeapiVotes: 0GitHub stars: 124
Generate TaxonomyADevelop hierarchical classification systems. Creates parent-child categorical structures for content organization.documentationgotestingVotes: 0GitHub stars: 124
Generate ThesaurusAGenerate controlled vocabulary thesaurus for content domains. Creates comprehensive thesauri with preferred terms, broader/narrower/related terms.documentationsecuritydocumentationVotes: 0GitHub stars: 124
Hunt AptAHunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings.researchsecurityVotes: 0GitHub stars: 124
Hunt Credential AccessAHunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.securitysqlsecurityVotes: 0GitHub stars: 124
Hunt IocAHunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.documentationsecuritydocumentationVotes: 0GitHub stars: 124
Hunt Lateral MovementAHunt for lateral movement using PsExec, WMI, or similar techniques. Use when proactively searching for attackers moving through your network using admin tools. Searches for service installations, remote process execution, and suspicious network correlations.researchshellnodeVotes: 0GitHub stars: 124
Hunt ThreatAConduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation.researchgoshellVotes: 0GitHub stars: 124
Inventory ContentASystematic cataloging of information assets. Creates comprehensive inventories of all content with metadata and characteristics.documentationgodocumentationVotes: 0GitHub stars: 124
Pivot On IocAExplore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.toolsgoVotes: 0GitHub stars: 124
Respond Compromised AccountARespond to a potentially compromised user account. Use when impossible travel, credential stuffing, successful phishing, or suspicious activity indicates account compromise. Investigates activity, contains the account, removes persistence, and restores access.securitygogitVotes: 0GitHub stars: 124
Respond MalwareARespond to a malware incident following PICERL methodology. Use when malware is detected on endpoints. Orchestrates triage, containment, eradication, and recovery. Works with triage-malware skill for analysis.businessgosecurityVotes: 0GitHub stars: 124
Respond PhishingARespond to a reported phishing email following PICERL methodology. Use when a phishing email is reported or detected. Analyzes artifacts, identifies recipients who clicked, contains malicious IOCs, and removes emails from mailboxes.securitygogitVotes: 0GitHub stars: 124
Respond RansomwareARespond to a ransomware incident following PICERL methodology. Use when ransomware is detected or suspected. Orchestrates identification, containment, eradication, and recovery phases. Requires CASE_ID and initial indicators.securitygosecurityVotes: 0GitHub stars: 124
Triage AlertATriage a security alert or case. Use when given an ALERT_ID or CASE_ID to assess if it's a real threat. Enriches IOCs, searches SIEM for context, and determines if the alert should be closed (false positive) or escalated for investigation.researchgitsecurityVotes: 0GitHub stars: 124
Triage MalwareATriage a suspected malicious file hash. Use when investigating malware alerts or suspicious files. Analyzes GTI file report, behavioral indicators, identifies affected hosts, enriches network IOCs, and recommends containment actions.securitysecuritydocumentationVotes: 0GitHub stars: 124
Triage Suspicious LoginATriage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.securityrustgitVotes: 0GitHub stars: 124
Cluster DocumentsAAutomated content similarity and grouping analysis. Groups related documents by topic, purpose, or content similarity.ai-agentsgoVotes: 0GitHub stars: 124