blue-team plugins

by Matt Corbett

Blue-team DFIR / SOC team — agents (dfir-response-lead, detection-and-forensics-engineer) for running a security incident end to end: the incident lifecycle per NIST SP 800-61r3 (CSF 2.0-aligned; supersedes r2; 4 phases: preparation -> detection & analysis -> containment/eradication/recovery -> post-incident), triage & severity classification, containment strategy, breach coordination + comms + regulatory notification (GDPR 72h), tabletops; and detection engineering (SIEM/Sigma rules mapped to MITRE ATT&CK, alert tuning), hypothesis-driven threat hunting, evidence acquisition & forensics (order of volatility per RFC 3227, chain of custody), and malware triage. skills, a knowledge bank with two Mermaid decision trees + a dated 2026 DFIR tooling map, best-practices, templates, an advisory hook. Seams: appsec/secure-coding -> security-engineering; governance/risk/audit -> cybersecurity-grc; reliability incidents -> observability-sre; platform abuse -> trust-and-safety. Requires ravenclaude-core@>=0.7.0.

by Gregory Block

The research debate engine for Special Circumstances: an additive blue side builds, a subtractive red side audits and owns the pass/fail gate, an engine runs the mechanics and the bench rules the final compromise. Best-of-N, the Catechism (a worth-our-time decision), and the full record preserved.