OPENCODE COMPATIBLE

DFIR Skills for
AI Agents

Executable procedures for threat hunting, detection engineering, digital forensics and incident response — each one a SKILL.md an agent can follow during an investigation.

// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "skills": {
    "urls": ["https://dfirskills.com/index.json"]
  }
}

Restart opencode after editing the config — it is read once at startup.

SK

2792 skills

Imaging and carving, memory and timeline analysis, registry and browser artifacts, network and detection engineering.
RL

32982 detection rules

Sigma detections carrying their own ATT&CK techniques, products and log sources, synced from upstream.
IN

1201 intel posts

What happened, who is affected, the indicators and what defenders should do — cross-linked to the skills that share a tool or CVE.
TL

1183 tools

Browse by the tool you actually run — Volatility, Plaso, Velociraptor, YARA, Suricata, Zeek and the rest.
Operational — steps for a console, not background reading. Attributed — every entry cites the source it came from. Current — new tooling lands on its own. See the setup.