tsale/awesome-dfir-skills · Archived
Initial incident intake & scoping
First-hour intake checklist + questions that produce an actionable scope and evidence plan.
Installation
npx skills add https://github.com/tsale/awesome-dfir-skills
Stronger alternatives
This repository is archived — consider an actively maintained alternative.
Professional malware analysis workflow for PE executables and suspicious files. Triggers on fil…
73 installsHelp users write, validate, and troubleshoot osquery SQL queries using provided osquery table s…
11 installsAnalyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of th…
11 installsBuild structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this…
7 installsSimilar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we…
5.4K installsRun a deep root-cause investigation on the AWS DevOps Agent. Use when the user describes an inc…
1.1K installsCreate structured incident response runbooks with step-by-step procedures, escalation paths, an…
9.6K installsInvoke the `incidentio` CLI to drive the incident.io API — incidents, actions, follow-ups, aler…
3.1K installsConfigures the Incident Priority Matrix for Salesforce ITSM through the sf CLI — enabling or di…
1.6K installsEnd-to-end Incident SLA setup for Service Cloud ITSM — creating a MilestoneType, an Incident-sc…
1.1K installsAlso in this package
Other skills from tsale/awesome-dfir-skills.
npx skills add https://github.com/tsale/awesome-dfir-skills
More details
Agent compatibility
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Repository health
main
History
- First recorded snapshot · 4 installs