threadlinqs-cmd/Threadlinqs-Security-Detection-MCP

Unified Detection Engineering Platform — 7,283+ detections across Sigma, Splunk ESCU, Elastic & KQL, powered by MCP

15 files for Claude Code and Cursor: WORKFLOW-LESSONS, atomic-executor, attack-range-builder, coverage-analyzer and 11 more .

Open on GitHub

Agents

WORKFLOW-LESSONS .cursor/agents/WORKFLOW-LESSONS.md A —
atomic-executor .cursor/agents/atomic-executor.md A 21 tok
attack-range-builder .cursor/agents/attack-range-builder.md A 22 tok
coverage-analyzer .cursor/agents/coverage-analyzer.md A 22 tok
cti-analyst .cursor/agents/cti-analyst.md A 29 tok
data-dumper .cursor/agents/data-dumper.md A 23 tok
detection-engineer .cursor/agents/detection-engineer.md A 32 tok
fp-analyst .cursor/agents/fp-analyst.md A 19 tok
orchestrator .cursor/agents/orchestrator.md A 15 tok
pr-reviewer .cursor/agents/pr-reviewer.md A 29 tok
pr-stager .cursor/agents/pr-stager.md A 28 tok
qa-reviewer .cursor/agents/qa-reviewer.md A 17 tok
siem-validator .cursor/agents/siem-validator.md A 23 tok
splunk-validator .cursor/agents/splunk-validator.md A 38 tok
verifier .cursor/agents/verifier.md A 21 tok

These files are threadlinqs-cmd/Threadlinqs-Security-Detection-MCP's own configuration — they tell Claude Code and Cursor how to work on this repository, so they are not mods to install elsewhere. Copy one as a starting point and replace the parts that are about this project.