3 tagged detection-engineering, measured the same way as everything else here.
Plugin Claude Code
Bundles 2 skills · 423 tokens together
Skills packaging the Gauntlet Loop — build → blind-critic → revise → repeat against a hard bar — for coding, writing, design, data, research, prompt evaluation, detection engineering, and authorized security testing.
Plugin Claude Code
Bundles 3 skills, 1 MCP server · 74 tokens together
Sigma detection rule writing, validation, and conversion for SOC analysts and threat-intel teams. LLM-assisted draft + pySigma validation + multi-backend conversion (Splunk, Elastic, OpenSearch; Wazuh through the Elastic Lucene backend) with logsource-aware processing pipelines. Ships a 294-rule published corpus…
threadlinqs-cmd/intelthreadlinqs-mcp
Plugin Claude Code
Curated cyber-threat intelligence in Claude — 81 read-only tools across threats, SPL/KQL/Sigma detections, IOCs, MITRE ATT&CK, CVE/CWE, C2 infrastructure, and threat-actor attribution. Purple/Gold tier.