Skill Claude Code
Investigate queued TRUDI alerts or resume an open live investigation, with gated source containment, native evidence collection, and reporting.
Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response
This repository also configures its own agents. See what trudi tells them →
Skill Claude Code
Investigate queued TRUDI alerts or resume an open live investigation, with gated source containment, native evidence collection, and reporting.
Skill Claude CodeCodex
Load or initialize TRUDI live-monitoring watchers; compatibility name for the trudi-start-watcher workflow.
Skill Claude CodeCodex
Start or check TRUDI live-monitoring producers for a case, including signed CEF ingest and baseline-backed endpoint watchers.
Skill Claude CodeCodex
Stop a TRUDI case's CEF ingest or endpoint watcher producers while preserving alerts, investigations, and evidence.
Skill Claude CodeCodex
Keep a Codex turn watching a TRUDI case for new alerts and run the live investigation workflow when they arrive.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: