willwebster5/agent-skills

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-behavioral-detections

Design multi-event behavioral detection rules using CrowdStrike NG-SIEM correlate() function. Use when building attack chain detections, correlating multiple events across time windows, or creating behavioral rules that detect complex threat patterns across AWS, EntraID, and CrowdStrike data sources.

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-cql-patterns

CQL pattern catalog — curated detection engineering patterns for CrowdStrike NG-SIEM. Use when writing, reviewing, or debugging CQL queries.

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-detection-tuning

Analyze CrowdStrike NGSIEM detections for tuning opportunities based on environmental context, recent false positives, and available enrichment functions. Use when tuning detections (including behavioral rules with correlate()), reducing false positives, enhancing detection coverage, or reviewing OOTB templates for…

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-fusion-workflows

Build CrowdStrike Falcon Fusion SOAR workflows. Discover actions via live API, author YAML using our resource schema, validate locally, and save to resources/workflows/. Use when asked to create a Fusion workflow, SOAR playbook, or automate detection response.

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-logscale-security-queries

Develop, optimize, and troubleshoot CrowdStrike LogScale (Humio) security detection queries using CQL syntax. Use when writing LogScale queries, building security detections, creating threat hunting rules, fixing CQL syntax errors, working with CrowdStrike EDR/Falcon security monitoring, or building behavioral rules…

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-response-playbooks

Detection-to-response mapping and SOAR playbook design. Analyzes detections, recommends tiered response actions (observe, investigate, contain, remediate), and produces handoff docs for fusion-workflows to generate workflow YAML. Use when planning response automation for detections, designing SOAR playbooks, or…

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-soc-agents

Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Agent-delegated architecture: Haiku for mechanical tasks, Sonnet for substantive work, Opus for judgment.

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-soc

Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Use when triaging alerts, investigating detections, running daily SOC review, or tuning for false positives.

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-source-threat-modeling

Threat-model-first detection planning for data sources without OOTB coverage. Analyzes what threats apply to a source type, validates against live log data, and produces a prioritized detection backlog with handoff docs for authoring skills. Use when onboarding a new data source, planning detection coverage for a…

willwebster5/agent-skills

Skill Claude CodeCodex

Part of crowdstrike-threat-hunting

Autonomous threat hunting using the PEAK framework (Prepare → Execute → Act). Executes hypothesis-driven, intelligence-driven, and baseline hunts against CrowdStrike NG-SIEM. Produces hunt reports, detection backlogs, and visibility gap reports. Use when proactively hunting for threats, validating detection coverage…