159 tagged incident-response, measured the same way as everything else here.
Browse within: cybersecurity 86forensics 49mitre-attack 46malware-analysis 37dfir 31memory-forensics 27penetration-testing 27blueteaming 24codex-cli 24gemini-cli 24pentesting 24appsec 22bug-bounty 22malware 21
Skill Claude CodeCodex
Turn a MITRE ATT&CK/ATLAS threat group or case study — or a frontier AI agent deployed inside the organisation — into a full incident-response tabletop exercise (MSEL): scenario narrative, kill chain or agent threat scope, timestamped injects, discussion questions, and a detection-coverage scorecard, using the…
Skill Claude CodeCodex
Grade a periodic outbound flow as c2, suspicious, or benign-periodic. Read this when rawdata shows a repeating connection and you must separate a beacon from NTP, an update check, a monitoring agent, or telemetry.
Skill Claude CodeCodex
Read-only Kubernetes incident triage using kubectl. Accepts natural language or structured input. Produces root-cause hypotheses, evidence, and next-step commands.
Lethe044/hermes-incident-commander
Skill Claude CodeCodex
Autonomous incident detection, root-cause analysis, and self-healing for Linux/Docker production environments. Activate when the user mentions: server down, high CPU, memory leak, disk full, service crash, deployment failure, alert firing, on-call page, or any infrastructure emergency. Also activates on scheduled…
Skill Claude CodeCodex needs its repo
Research, author, and validate AI agent artifact catalog entries documenting the forensic artifacts AI agents leave on endpoints - install paths, config and credential files, MCP server configs, listening ports, process trees, registry keys, and the Windows event log records that prove a tool ran. Use this skill…
Skill Claude CodeCodex needs its repo
A read-only log and metrics lookup guide for an ad-agent project. It covers campaign performance logs, budget-change records, time-window comparisons, and tracing errors by identifier.
Skill Claude CodeCodex
Which Valhuntir MCP tool or SIFT tool to use for a question, file, IOC or artifact, and the step-by-step workflows that combine them (IOC investigation, threat actor research, detection engineering, malware analysis, disk, memory, timeline and network). Use when choosing tools or planning a multi-step analysis.
cacheforge-ai/cacheforge-skills
Skill Claude CodeCodex
Kubernetes Cluster Triage & Diagnostics — instant AI-powered incident triage via kubectl.
Skill Claude CodeCodex
Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains…
HermeticOrmus/LibreSecOps-Claude-Code
Skill Claude CodeCodex
Microsegmentation operates at multiple layers, each providing different granularity and capabilities.
Skill Codex
Detection rules engineering skill for SIEM logic, alert design, telemetry mapping, tuning, and false-positive reduction.
Skill Claude CodeCodex
Diagnose live Kubernetes failures (CrashLoopBackOff, OOMKilled, NodeNotReady, ImagePullBackOff, Network/CNI failures, HPA starvation, DNS failures, pending pods) with an evidence-first procedure: capture context, collect signals (events/status/logs), rank falsifiable hypotheses, verify one variable at a time, fix with…
Wave-Engineering/mcp-server-wtf
Skill Claude CodeCodex
Retrieve a distilled timeline of the current troubleshooting incident and generate a runbook skeleton. Returns a concise summary by default, or the full untruncated timeline on request.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: