alert-correlation
De la autor
Find related Wazuh activity around a case by time window and entity pivots, detect kill-chain progression and campaigns across hosts; use after triage when a case needs its surrounding context.
Instalare
npx skills add gensecaihq/Wazuh-Autopilot --skill alert-correlation -a claude-code
Se instalează în .claude/skills/alert-correlation/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
Vrei ca agentul să-ți propună skill-uri în timp ce scrii? Vezi cum folosești skill-urile din IDE.
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 80
aiqbench calculează scorul de încredere din semnale publice. Nu este un audit de securitate, așa că citește un skill înainte să-l instalezi.
Skill-uri similare
Cele mai apropiate de acesta prin ce fac și când sunt folosite.
- wazuh-windows-sysmongensecaihq/Wazuh-AutopilotInterpret Wazuh Windows EventChannel and Sysmon alerts — logon, privilege, account and service events, Sysmon detection groups, field paths and logon types — mapping Windows Event IDs to Wazuh rules; use for any Windows or Sysmon alert and for Windows-focused hunts.Altele★ 60
- entity-extractiongensecaihq/Wazuh-AutopilotExtract and normalize IPs, hosts, users, processes, files, hashes and domains from Wazuh alert JSON with attacker/victim/observed roles; use when opening or enriching a case from alerts.Altele★ 60
- security-alert-triageelastic/agent-skillsTriage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.OficialSecuritate★ 600
- threat-huntinggensecaihq/Wazuh-AutopilotRun hypothesis-driven threat hunts over Wazuh data using the PEAK framework (hypothesis, baseline, model-assisted), record outcomes, and hand confirmed patterns to detection engineering; use for scheduled hunts or when asked to look for undetected activity.Altele★ 60
- wazuh-active-responsegensecaihq/Wazuh-AutopilotHow Wazuh active response actually works — commands, agent-side scripts, dispatch vs execution, permanence, blast radius, pre-checks and verification caveats — for planning and verifying containment; use before proposing or verifying any response action.Planificare★ 60
- wazuh-platform-healthgensecaihq/Wazuh-AutopilotKeep the Wazuh platform trustworthy — agent connectivity and version drift, manager and cluster health, event queue flooding and dropped events, silent log sources, FIM capacity and rule/decoder errors — and raise detection blind spots as cases; use for the scheduled platform health check or whenever data looks missing.Altele★ 60
Note și recenzii
—
nicio recenzie
Ai încercat acest skill? Notează-l ca să-i ajuți pe alții. Autentifică-te
Discuție
Intră în discuție. Autentifică-te