trudi
01Settings file Claude Code
Agent settings declaring 1 allowed tools.
52 4d ago B
tokens not measured
original MIT
Command
Drain TRUDI live-monitoring alerts and run a per-tick investigation over the bundle.
52 4d ago A 17 tokens
original MIT
Command
Clear a TRUDI case for a fresh run — preview everything, confirm, then wipe outputs + project memory (and live monitoring state).
52 4d ago C 27 tokens
original MIT
Command
Start the TRUDI live-monitoring watcher (baseline + detectors + sidecar) for a case.
52 4d ago A 19 tokens
original MIT
Command
Stop the TRUDI live-monitoring watcher(s) for a case (SIGTERM sidecar, clear event table).
52 4d ago A 23 tokens
original MIT
Command
Event-driven TRUDI live-monitoring loop — wake on a new alert within seconds (no 60s /loop floor) and auto-respond.
52 4d ago A 29 tokens
original MIT
Skill Claude CodeCodex
Use this skill for all memory image analysis on the SIFT workstation. Always run as root (sudo su) — some plugins require elevated privileges to resolve symbols.
52 4d ago B 0 tokens
original MIT
Skill Claude CodeCodex
Use this skill for all super-timeline creation, filtering, and analysis tasks using the Plaso suite on the SANS SIFT workstation. Plaso parses hundreds of artifact types from disk images, mounted filesystems, and individual files into a unified timeline.
52 4d ago B 0 tokens
original MIT
sleuthkit
09Skill Claude CodeCodex
Use this skill for disk image analysis, filesystem navigation, file extraction, and file carving on the SIFT workstation. Evidence images are commonly in E01 (Expert Witness Format). Always mount read-only to preserve evidence integrity.
52 4d ago B 0 tokens
original MIT
Skill Claude CodeCodex
Use this skill for Windows host-based artifact analysis on the SIFT workstation. Covers Eric Zimmerman (EZ) Tools, ASEP/persistence analysis, Windows event log parsing, and execution/access evidence artifacts.
52 4d ago A 0 tokens
original MIT
yara-hunting
11Skill Claude CodeCodex
Use this skill for IOC sweeps, malware identification, and threat hunting. YARA 4.1.0 runs locally on SIFT Linux for scanning files and memory images. Velociraptor is an endpoint agent — hunts are deployed via its web console, not run directly from the SIFT command line.
52 4d ago A 0 tokens
original MIT