nebulae/trudi

Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response

This repository also configures its own agents. See what trudi tells them →

67Stars on the repository
11Mods indexed here, across every type
5d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown

trudi-check-alerts

01

nebulae/trudi

Skill Claude Code

Investigate queued TRUDI alerts or resume an open live investigation, with gated source containment, native evidence collection, and reporting.

not rated 67 +1 5d ago A 31 tokens original MIT

trudi-load-watcher

02

nebulae/trudi

Skill Claude CodeCodex

Load or initialize TRUDI live-monitoring watchers; compatibility name for the trudi-start-watcher workflow.

not rated 67 +1 5d ago A 27 tokens original MIT

trudi-start-watcher

03

nebulae/trudi

Skill Claude CodeCodex

Start or check TRUDI live-monitoring producers for a case, including signed CEF ingest and baseline-backed endpoint watchers.

not rated 67 +1 5d ago A 30 tokens original MIT

trudi-stop-watcher

04

nebulae/trudi

Skill Claude CodeCodex

Stop a TRUDI case's CEF ingest or endpoint watcher producers while preserving alerts, investigations, and evidence.

not rated 67 +1 5d ago A 28 tokens original MIT

trudi-watch-alerts

05

nebulae/trudi

Skill Claude CodeCodex

Keep a Codex turn watching a TRUDI case for new alerts and run the live investigation workflow when they arrive.

not rated 67 +1 5d ago A 29 tokens original MIT

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: