soc plugins

by Matt Corbett

Blue-team DFIR / SOC team — agents (dfir-response-lead, detection-and-forensics-engineer) for running a security incident end to end: the incident lifecycle per NIST SP 800-61r3 (CSF 2.0-aligned; supersedes r2; 4 phases: preparation -> detection & analysis -> containment/eradication/recovery -> post-incident), triage & severity classification, containment strategy, breach coordination + comms + regulatory notification (GDPR 72h), tabletops; and detection engineering (SIEM/Sigma rules mapped to MITRE ATT&CK, alert tuning), hypothesis-driven threat hunting, evidence acquisition & forensics (order of volatility per RFC 3227, chain of custody), and malware triage. skills, a knowledge bank with two Mermaid decision trees + a dated 2026 DFIR tooling map, best-practices, templates, an advisory hook. Seams: appsec/secure-coding -> security-engineering; governance/risk/audit -> cybersecurity-grc; reliability incidents -> observability-sre; platform abuse -> trust-and-safety. Requires ravenclaude-core@>=0.7.0.

by Dtwo

Manage Dtwo gateways, policies, and Rego with the Dtwo MCP server.

by mlab.sh

Analyst-grade threat intelligence workflows on top of the mlab.sh platform: IOC triage, SBOM vulnerability audits, threat actor profiling and phishing/smishing triage.

by Bohica Labs

ICS/OT Security Operations — CVE enrichment, event investigation, MITRE ATT&CK mapping, and adversarial quality review with convergence-driven analysis.