DFIR Skills for
AI Agents
Executable procedures for threat hunting, detection engineering,
digital forensics and incident response — each one a
SKILL.md an agent can follow during an investigation.
Restart opencode after editing the config — it is read once at startup.
2961 skills
Imaging and carving, memory and timeline analysis, registry and browser artifacts, network and detection engineering.
33342 detection rules
Sigma detections carrying their own ATT&CK techniques, products and log sources, synced from upstream.
1946 intel posts
What happened, who is affected, the indicators and what defenders should do — cross-linked to the skills that share a tool or CVE.
1268 tools
Browse by the tool you actually run — Volatility, Plaso, Velociraptor, YARA, Suricata, Zeek and the rest.