sigma plugins

by Matt Corbett

Customer-Success analytics team — specialist agents (cs-analytics-architect, churn-signal-analyst) that own the DOMAIN layer of a CS-health analytics build: the conformed account / health-snapshot / renewal data model, which signals compose the health view, and the transparent rule-based Green/Yellow/Red risk tier (every Red shows why) — no black-box ML in phase one. Domain-neutral: it sits on top of data-platform's pipeline/warehouse/connector layer (which it routes all plumbing to) rather than duplicating it. skills, best-practice rules, a knowledge bank (CS-health/churn signals, renewal lifecycle, NRR/GRR retention metrics, consolidated + risk-tier-escalation Mermaid decision trees), a scenarios bank (field notes), a stdlib cs_calc.py (NRR-GRR + weighted health-score + renewal-risk), and data-model + tier-design templates whose identity spine points at data-platform. Pairs with data-platform; seams to salesforce / tableau / edtech-partner-success. Requires ravenclaude-core@>=0.7.0.

by Matt Corbett

Data-platform team — agents (database-setup-guide, etl-pipeline-engineer, dashboard-builder, connector-developer) for cloud DBs, ELT (Airbyte / Fivetran / n8n) with connectors for QuickBooks / Stripe / Salesforce / HubSpot / GA4 / Shopify / HRIS / Planhat / Intercom / Slack-as-source plus 8-vendor support-tool integration coverage (Zendesk, Freshdesk, Intercom Conv+Tkt, SFDC Service Cloud, JSM, HubSpot Service, Help Scout, Front + 2026 Fivetran connector-MAR build-vs-buy math), and embedded dashboards (Evidence.dev / Superset / Metabase / Cube + Tremor). skills (incl. support-ticket-normalization — conformed fct_ticket / fct_conversation_event over 8 vendors; cross-system-identity-resolution — the Salesforce↔Planhat↔Intercom↔Slack account spine), templates, a knowledge bank, best-practices. Opinionated against per-viewer-priced BI for greenfield SMB. Requires ravenclaude-core@>=0.7.0.

by Matt Corbett

Blue-team DFIR / SOC team — agents (dfir-response-lead, detection-and-forensics-engineer) for running a security incident end to end: the incident lifecycle per NIST SP 800-61r3 (CSF 2.0-aligned; supersedes r2; 4 phases: preparation -> detection & analysis -> containment/eradication/recovery -> post-incident), triage & severity classification, containment strategy, breach coordination + comms + regulatory notification (GDPR 72h), tabletops; and detection engineering (SIEM/Sigma rules mapped to MITRE ATT&CK, alert tuning), hypothesis-driven threat hunting, evidence acquisition & forensics (order of volatility per RFC 3227, chain of custody), and malware triage. skills, a knowledge bank with two Mermaid decision trees + a dated 2026 DFIR tooling map, best-practices, templates, an advisory hook. Seams: appsec/secure-coding -> security-engineering; governance/risk/audit -> cybersecurity-grc; reliability incidents -> observability-sre; platform abuse -> trust-and-safety. Requires ravenclaude-core@>=0.7.0.