Instructions file
Claude Code instructions for samaritan0/dfir-agentic-suite, covering dfir agentic skills suite for claude code, skills, dfir-orchestrator (the agentic brain), ioc-extractor and windows-artifact-triage.
Skill Claude CodeCodex
Agentic DFIR orchestrator that autonomously investigates security incidents by chaining forensic skills (IOC extraction, Windows artifact triage, timeline correlation, YARA generation) with an autonomous reasoning loop, persistent case state, and human-in-the-loop approvals. Use this skill whenever the user mentions…
Skill Claude CodeCodex
Extract and enrich Indicators of Compromise (IOCs) from any input — log files, alerts, emails, pastes, forensic tool output, threat intel reports, or raw text. Extracts IPs, domains, URLs, file hashes (MD5/SHA1/SHA256), email addresses, CVE IDs, Bitcoin/Ethereum addresses, MITRE ATT&CK technique IDs, and…
Skill Claude CodeCodex
Parse, normalize, and correlate forensic timelines from Plaso/log2timeline (l2tcsv, jsonline), Hayabusa (CSV/JSONL), Chainsaw (JSON), and raw log files (syslog, auth.log, JSON-formatted logs, Windows XML event logs). Produces unified UTC timelines, detects attack sequences, and maps findings to MITRE ATT&CK. Use this…
MCP server Claude CodeCodexCursor +2
MCP server "dfir-threatintel" as configured in samaritan0/dfir-agentic-suite. Runs dfir_threatintel_mcp with python3. Needs 5 environment variables to run.
MCP server Claude CodeCodexCursor +2
MCP server "dfir-siem" as configured in samaritan0/dfir-agentic-suite. Runs dfir_siem_mcp with python3. Needs 8 environment variables to run.
MCP server Claude CodeCodexCursor +2
MCP server "dfir-case-mgmt" as configured in samaritan0/dfir-agentic-suite. Runs dfir_case_mgmt_mcp with python3. Needs 5 environment variables to run.
MCP server Claude CodeCodexCursor +2
MCP server "dfir-edr-response" as configured in samaritan0/dfir-agentic-suite. Runs dfir_edr_response_mcp with python3. Needs 7 environment variables to run.
Skill Claude CodeCodex
Parse and correlate Windows forensic artifacts from EZTools (Eric Zimmerman), KAPE, Chainsaw, Hayabusa, and raw event logs. Handles CSV output from EvtxECmd, MFTECmd, PECmd (Prefetch), AmcacheParser, AppCompatCacheParser, SBECmd (ShellBags), LECmd (LNK files), JLECmd (Jump Lists), and RECmd (Registry). Also parses…
Skill Claude CodeCodex
Generate YARA rules from behavioral descriptions, malware samples, forensic findings, or threat intelligence reports. Produces well-structured YARA rules with metadata, string patterns, and conditions. Supports PE-specific features (imports, exports, sections, imphash), magic byte detection, and condition logic. Can…