nebulae/trudi

Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response

52Stars on the repository
11Mods indexed here, across every type
5d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown

trudi-check-alerts

01

nebulae/trudi

Command

Drain TRUDI live-monitoring alerts and run a per-tick investigation over the bundle.

52 5d ago A 17 tokens original MIT

trudi-clear-case

02

nebulae/trudi

Command

Clear a TRUDI case for a fresh run — preview everything, confirm, then wipe outputs + project memory (and live monitoring state).

52 5d ago C 27 tokens original MIT

trudi-start-watcher

03

nebulae/trudi

Command

Start the TRUDI live-monitoring watcher (baseline + detectors + sidecar) for a case.

52 5d ago A 19 tokens original MIT

trudi-stop-watcher

04

nebulae/trudi

Command

Stop the TRUDI live-monitoring watcher(s) for a case (SIGTERM sidecar, clear event table).

52 5d ago A 23 tokens original MIT

trudi-watch-alerts

05

nebulae/trudi

Command

Event-driven TRUDI live-monitoring loop — wake on a new alert within seconds (no 60s /loop floor) and auto-respond.

52 5d ago A 29 tokens original MIT