Command Claude Code
Ingest threat-intelligence IOC data from local files, normalize it, and correlate it across sources, against Sigma rule coverage, and optionally against local Hayabusa evidence.
Command Claude Code
Full endpoint investigation combining SIEM queries and Hayabusa MCP analysis, correlated and mapped to MITRE ATT&CK.
Command Claude Code
Query SIEM and check detection coverage.
Hook Claude Code
Runs when a session starts, executing check-prereqs.sh. From omeryemba/mcp-hayabusa.
Hook Claude Code
Runs before the agent uses a tool, executing check-sensitive.sh. From omeryemba/mcp-hayabusa.
Hook Claude Code
Runs after a tool call finishes for Write, Edit, Write and Edit tool calls, executing log_modified_file.py and validate-rule.sh via python (2 commands). From omeryemba/mcp-hayabusa.
Hook Claude Code
Runs when the agent finishes a response, executing notify-complete.sh. From omeryemba/mcp-hayabusa.
Settings file Claude Code
Agent settings declaring 4 hook events (SessionStart, PreToolUse, PostToolUse, Stop) and 2 allowed tools.
Skill Claude CodeCodex
Use when writing or creating Sigma rules, reviewing detection rules, discussing detection coverage, or working with YAML detection files. Enforces this project's detection rule standards (ATT&CK mapping, severity justification, false positive documentation, test cases, naming conventions).
Skill Claude CodeCodex
Use when ingesting threat-intelligence IOC data (native JSON lists, MISP JSON event exports), normalizing indicators to a common schema, or correlating them across sources and against this project's Sigma rule coverage. Enforces the normalized IOC schema and the v1 scope limits below.
MCP server Claude CodeCodexCursor
MCP server "hayabusa" as configured in omeryemba/mcp-hayabusa. Launched with mcp-hayabusa.
Instructions file
Claude Code instructions for omeryemba/mcp-hayabusa, covering claude.md, what this is, commands, install (editable, with test deps) and tests.