nebulae/trudi

Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response

This repository also configures its own agents. See what trudi tells them →

67Stars on the repository
11Mods indexed here, across every type
5d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown

trudi-check-alerts

01

nebulae/trudi

Command Claude Code

Drain TRUDI live-monitoring alerts and run a per-tick investigation over the bundle.

not rated 67 +1 changed 4d ago A 17 tokens original MIT

trudi-start-watcher

02

nebulae/trudi

Command Claude Code

Start the TRUDI live-monitoring watcher (baseline + detectors + sidecar) for a case.

not rated 67 +1 changed 4d ago A 19 tokens original MIT

trudi-stop-watcher

03

nebulae/trudi

Command Claude Code

Stop the TRUDI live-monitoring watcher(s) for a case (SIGTERM sidecar, clear event table).

not rated 67 +1 5d ago A 23 tokens original MIT

trudi-watch-alerts

04

nebulae/trudi

Command Claude Code

Event-driven TRUDI live-monitoring loop — wake on a new alert within seconds (no 60s /loop floor) and auto-respond.

not rated 67 +1 changed 4d ago A 29 tokens original MIT

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: