willwebster5

willwebster5/crowdstrike-mcp

MCP server Claude CodeCodexCursor +2

MCP server for the CrowdStrike Falcon platform. Runs locally from the crowdstrike-mcp Python package.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 61 tokens together

Design multi-event behavioral detection rules using CrowdStrike NG-SIEM correlate() function for attack chain detections across AWS, EntraID, and CrowdStrike data sources.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 34 tokens together

Curated CQL detection engineering pattern catalog for CrowdStrike NG-SIEM — correlation, enrichment, aggregation, scoring, baselining, and more.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 60 tokens together

Analyze and tune CrowdStrike NGSIEM detections for false positive reduction using 38 enrichment functions across AWS, EntraID, GitHub, and network data sources.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 55 tokens together

Build CrowdStrike Falcon Fusion SOAR workflows — discover actions via live API, author YAML, validate locally, and deploy automation playbooks.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 93 tokens together

Develop, optimize, and troubleshoot CrowdStrike LogScale security detection queries using CQL — includes case statements, multi-event correlation, investigation playbooks, and hunting rules.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 75 tokens together

Detection-to-response mapping and SOAR playbook design — analyzes detections, recommends tiered response actions, and produces handoff docs for Falcon Fusion workflow generation.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 54 tokens together

Agent-delegated SOC workflow for CrowdStrike NGSIEM — distributes triage, investigation, and evidence collection across specialized sub-agents (Haiku for mechanical, Sonnet for substantive, Opus for judgment).

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill, 1 command · 50 tokens together

Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, tune detections, and manage cases through a phased lifecycle.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 80 tokens together

Threat-model-first detection planning for data sources without OOTB coverage — analyzes threats, validates against live log data, and produces prioritized detection backlogs.

willwebster5/agent-skills

Plugin Claude Code

Bundles 1 skill · 71 tokens together

Autonomous threat hunting using the PEAK framework — hypothesis-driven, intelligence-driven, and baseline hunts against CrowdStrike NG-SIEM with hunt reports and detection backlogs.