entity-extraction
From the author
Extract and normalize IPs, hosts, users, processes, files, hashes and domains from Wazuh alert JSON with attacker/victim/observed roles; use when opening or enriching a case from alerts.
Install
npx skills add gensecaihq/Wazuh-Autopilot --skill entity-extraction -a claude-code
Installs to .claude/skills/entity-extraction/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 80
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- wazuh-windows-sysmongensecaihq/Wazuh-AutopilotInterpret Wazuh Windows EventChannel and Sysmon alerts — logon, privilege, account and service events, Sysmon detection groups, field paths and logon types — mapping Windows Event IDs to Wazuh rules; use for any Windows or Sysmon alert and for Windows-focused hunts.Other★ 60
- alert-correlationgensecaihq/Wazuh-AutopilotFind related Wazuh activity around a case by time window and entity pivots, detect kill-chain progression and campaigns across hosts; use after triage when a case needs its surrounding context.Productivity★ 60
- 意图识别与结构化提取ECNU-ICALK/AutoSkill根据用户输入的句子，识别其意图并按照指定的JSON格式返回动作、事项、范围和参数。适用于对特定业务场景的指令进行结构化解析。Other★ 606
- wazuh-malware-detectiongensecaihq/Wazuh-AutopilotInterpret Wazuh malware signals — rootcheck, VirusTotal and ClamAV integrations, Microsoft Antimalware events, Sysmon detections and suspicious binaries — and turn them into enrichment and containment hand-offs; use for any malware, rootkit or suspicious-binary alert.Security★ 60
- wazuh-cloud-containergensecaihq/Wazuh-AutopilotInterpret Wazuh cloud and container alerts — AWS (CloudTrail, GuardDuty, VPC Flow, Security Hub), Azure, GCP, Microsoft Graph, Office 365, GitHub and Docker — with their key fields, normal baselines and pivots; use for any alert from a cloud or container integration.Security★ 60
- mitre-attack-mappinggensecaihq/Wazuh-AutopilotMap Wazuh alerts and observed behaviour to MITRE ATT&CK techniques and tactics and record them on the case; use whenever you identify attacker behaviour or see rule.mitre data.Other★ 60
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in