dfir Cursor rules

9 tagged dfir, measured the same way as everything else here.

Browse within: code 6scripts 6

uv

01

Lazza/RecuperaBit

Cursor rule Cursor

Install Python packages, access Python CLI, run python code and scripts, execute Python commands, and manage Python environments. Use uv run for all Python execution instead of direct python commands.

not rated 625 +1 2mo ago A 186 tokens GPL-3.0

docker-building

02

TazWake/Public

Cursor rule Cursor

Rules for building and reviewing Docker components, including dockerfiles, docker-compose.yml and related files.

not rated 46 +1 1mo ago A 19 tokens original CC0-1.0

case-uco-sdk

03

vulnmaster/CASE-UCO-SDK

Cursor rule Cursor

CASE/UCO SDK usage patterns for building digital forensics investigation graphs.

not rated 9 changed 3d ago A 2,017 tokens original Apache-2.0

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: