Command Claude Code
Drain TRUDI live-monitoring alerts and run a per-tick investigation over the bundle.
Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response
This repository also configures its own agents. See what trudi tells them →
Command Claude Code
Drain TRUDI live-monitoring alerts and run a per-tick investigation over the bundle.
Command Claude Code
Start the TRUDI live-monitoring watcher (baseline + detectors + sidecar) for a case.
Command Claude Code
Stop the TRUDI live-monitoring watcher(s) for a case (SIGTERM sidecar, clear event table).
Command Claude Code
Event-driven TRUDI live-monitoring loop — wake on a new alert within seconds (no 60s /loop floor) and auto-respond.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: