digital forensics commands

7onez/cti-expert

Command

Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case [seed...].

7onez/cti-expert

Command

False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check.

7onez/cti-expert

Command

THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti [--deep|--quick|--passive].

kev365/xways-xtension-builder-skill

Command

Scaffold, wrap, port, audit, or document an X-Ways Forensics X-Tension (routes to the xways-xtension-authoring skill).

omeryemba/mcp-hayabusa

Command Claude Code

Ingest threat-intelligence IOC data from local files, normalize it, and correlate it across sources, against Sigma rule coverage, and optionally against local Hayabusa evidence.

omeryemba/mcp-hayabusa

Command Claude Code

Full endpoint investigation combining SIEM queries and Hayabusa MCP analysis, correlated and mapped to MITRE ATT&CK.

omeryemba/mcp-hayabusa

Command Claude Code

Query SIEM and check detection coverage.