All authors
Claude Skills by chrishuffman5
github.com/chrishuffman5446 skills0 installs53 views
- GuardicoreExpert agent for Akamai Guardicore micro-segmentation (formerly Guardicore Centra). Covers agent and agentless deployment, real-time visibility map, process-level segmentation policies, deception honeypots, east-west traffic analysis, label-based policy, and Guardicore Centra platform. WHEN: \"Guardicore\", \"Akamai Guardicore\", \"Guardicore Centra\", \"Guardicore micro-segmentation\", \"Guardicore deception\", \"process-level segmentation\", \"Guardicore visibility map\", \"Guardicore polic...Votes: 0GitHub stars: 4
- IamRouting agent for Identity & Access Management technologies. Covers SSO, MFA, federation, provisioning, governance, and cross-platform IAM architecture. WHEN: \"IAM\", \"identity management\", \"access management\", \"SSO\", \"MFA\", \"federation\", \"SCIM provisioning\", \"identity governance\", \"access review\", \"zero trust identity\". Do NOT use for platform-specific questions -- use the `entra-id`, `okta`, `ad-ds`, `auth0`, `keycloak`, `ad-fs`, `ad-cs`, `ping-identity`, `aws-iam`, `gcp-...Votes: 0GitHub stars: 4
- IllumioExpert agent for Illumio micro-segmentation platform. Covers Policy Compute Engine (PCE), Virtual Enforcement Node (VEN) agents, label-based policy model (role/app/environment/location), application dependency mapping, enforcement boundaries, ring-fencing, Illumio CloudSecure, and workload segmentation. WHEN: \"Illumio\", \"Illumio PCE\", \"VEN agent\", \"micro-segmentation\", \"Illumio policy\", \"workload segmentation\", \"enforcement boundary\", \"application dependency map\", \"Illumio Cl...Votes: 0GitHub stars: 4
- InfisicalExpert agent for Infisical open-source secrets manager. Covers self-hosted and cloud deployments, dynamic secrets, internal PKI, secret rotation, RBAC, Kubernetes operator, Terraform provider, and CLI. WHEN: \"Infisical\", \"Infisical self-hosted\", \"Infisical operator\", \"Infisical dynamic secrets\", \"Infisical PKI\", \"Infisical CLI\", \"infisical run\", \"Infisical secret rotation\".Votes: 0GitHub stars: 4
- KeycloakExpert agent for Keycloak open-source identity platform. Provides deep expertise in realms, clients, identity brokering, user federation, fine-grained authorization, Organizations, themes, and Quarkus-based deployment. WHEN: \"Keycloak\", \"realm\", \"identity brokering\", \"Keycloak client\", \"Keycloak federation\", \"Keycloak themes\", \"Keycloak authorization\", \"Keycloak Quarkus\", \"Keycloak Organizations\".Votes: 0GitHub stars: 4
- Lets EncryptExpert agent for Let's Encrypt free TLS certificates via ACME. Covers certbot, acme.sh, HTTP-01/DNS-01/TLS-ALPN-01 challenges, 90-day and 6-day certificate lifetimes, wildcard certificates, rate limits, staging environment, and automation best practices. WHEN: \"Let's Encrypt\", \"certbot\", \"acme.sh\", \"ACME\", \"free TLS\", \"LEGO\", \"Certify The Web\", \"short-lived certificate\", \"6-day certificate\", \"ACME challenge\", \"DNS-01 challenge\".Votes: 0GitHub stars: 4
- LogscaleExpert agent for CrowdStrike Falcon LogScale (formerly Humio). Provides deep expertise in LQL query development, index-free streaming architecture, real-time search, Falcon EDR integration, bloom filters, data compression, community edition, and high-volume log analytics. WHEN: \"LogScale\", \"Falcon LogScale\", \"Humio\", \"LQL\", \"LogScale query\", \"streaming SIEM\", \"index-free\", \"CrowdStrike SIEM\", \"LogScale community\".Votes: 0GitHub stars: 4
- MandiantExpert agent for Mandiant Threat Intelligence (Google). Covers APT/UNC actor tracking, Advantage platform modules, breach analytics, Attack Surface Management, Digital Threat Monitoring, Security Validation, Google SecOps/Chronicle integration, and Mandiant IR consulting expertise. WHEN: \"Mandiant\", \"Google Threat Intelligence\", \"GTI\", \"Advantage\", \"APT group\", \"UNC group\", \"breach analytics\", \"Mandiant IR\", \"FireEye\", \"Mandiant Academy\".Votes: 0GitHub stars: 4
- MendExpert agent for Mend (formerly WhiteSource) enterprise SCA platform. Covers dependency scanning, license compliance, vulnerability management, Renovate bot integration, SBOM export, and CI/CD integration. WHEN: \"Mend\", \"WhiteSource\", \"Mend SCA\", \"mend.io\", \"Renovate\", \"Renovate bot\", \"WhiteSource bolt\", \"Mend for Containers\".Votes: 0GitHub stars: 4
- MimecastExpert agent for Mimecast Email Security. Covers SEG, targeted threat protection, email continuity, DMARC analyzer, awareness training, and archiving/compliance. WHEN: \"Mimecast\", \"Mimecast SEG\", \"Mimecast URL protection\", \"Mimecast impersonation\", \"Mimecast continuity\", \"Mimecast DMARC\", \"Mimecast archive\", \"Mimecast awareness training\".Votes: 0GitHub stars: 4
- MispExpert agent for MISP (Malware Information Sharing Platform). Covers events, attributes, objects, galaxies, taxonomies, correlation engine, sharing groups, feeds, PyMISP, STIX/TAXII export, warninglists, and misp-modules enrichment. WHEN: \"MISP\", \"Malware Information Sharing Platform\", \"MISP event\", \"MISP feed\", \"PyMISP\", \"MISP galaxy\", \"MISP taxonomy\", \"MISP object\", \"sharing group\", \"misp-modules\".Votes: 0GitHub stars: 4
- NetskopeExpert agent for Netskope One SSE/SASE. Covers NewEdge infrastructure, CASB (40K+ apps), SWG, ZTNA Next, ML-powered DLP, UEBA, and Advanced Analytics. WHEN: \"Netskope\", \"Netskope CASB\", \"Netskope SWG\", \"Netskope ZTNA\", \"NewEdge\", \"Netskope DLP\", \"Netskope UEBA\", \"Netskope One\", \"Netskope inline\", \"Netskope tenant\".Votes: 0GitHub stars: 4
- Network SecurityRouting agent for network security technologies including IDS/IPS, NAC, and micro-segmentation. Cross-platform expertise in detection methodology, network visibility, east-west vs north-south traffic, and network forensics. WHEN: \"IDS\", \"IPS\", \"NAC\", \"network access control\", \"micro-segmentation\", \"network detection\", \"east-west traffic\", \"lateral movement detection\", \"network visibility\", \"Suricata\", \"Snort\", \"Zeek\", \"Cisco ISE\", \"ClearPass\", \"FortiNAC\", \"Illum...Votes: 0GitHub stars: 4
- OktaExpert agent for Okta identity platform. Provides deep expertise in Universal Directory, Adaptive MFA, Lifecycle Management, Workflows, API Access Management, ThreatInsight, and Identity Governance. WHEN: \"Okta\", \"Universal Directory\", \"OIN\", \"Okta Workflows\", \"Okta MFA\", \"Okta SSO\", \"ThreatInsight\", \"Okta Lifecycle\", \"Okta SCIM\", \"Okta API Access Management\".Votes: 0GitHub stars: 4
- OnetrustExpert agent for OneTrust GRC and privacy management. Covers privacy program management (GDPR, CCPA, DSAR automation, consent management, data mapping/RoPA), tech risk management, third-party risk, AI governance, and ethics and compliance. WHEN: \"OneTrust\", \"consent management\", \"DSAR automation\", \"data mapping\", \"RoPA\", \"OneTrust privacy\", \"OneTrust vendor risk\", \"AI governance OneTrust\", \"OneTrust GRC\".Votes: 0GitHub stars: 4
- OrcaExpert agent for Orca Security CNAPP platform. Covers agentless SideScanning technology, CSPM, CWPP, CIEM, DSPM, API security, AI-SPM, risk prioritization, and shift-left CI/CD integration. WHEN: \"Orca Security\", \"Orca SideScan\", \"Orca CNAPP\", \"Orca cloud security\", \"Orca risk score\", \"Orca CSPM\", \"Orca image scanning\", \"Orca shift left\".Votes: 0GitHub stars: 4
- OverviewTop-level routing agent for ALL security technologies and disciplines. Provides cross-domain expertise in security architecture, risk assessment, defense-in-depth, compliance frameworks, and threat modeling. WHEN: \"security architecture\", \"threat model\", \"NIST CSF\", \"MITRE ATT&CK\", \"defense in depth\", \"zero trust\", \"security assessment\", \"compliance framework\", \"CIS benchmarks\", \"incident response\", \"security posture\", \"attack surface\", \"risk management\", \"security ...Votes: 0GitHub stars: 4
- Ping IdentityExpert agent for Ping Identity platform. Provides deep expertise in PingOne cloud, PingFederate, PingAccess, PingDirectory, DaVinci orchestration, PingOne Protect, and PingOne Neo decentralized identity. WHEN: \"Ping Identity\", \"PingFederate\", \"PingOne\", \"PingAccess\", \"PingDirectory\", \"DaVinci\", \"PingOne Protect\", \"PingOne Neo\", \"Ping SSO\", \"Ping federation\".Votes: 0GitHub stars: 4
- PkiRouting agent for PKI and Certificate Lifecycle Management. Delegates to Let's Encrypt, Venafi, DigiCert, cert-manager, EJBCA, and smallstep specialists. Handles PKI design, CA hierarchy, X.509 concepts, ACME protocol, and certificate automation strategy. WHEN: \"PKI\", \"certificate authority\", \"CA hierarchy\", \"TLS certificate\", \"certificate lifecycle\", \"ACME\", \"X.509\", \"certificate rotation\", \"certificate renewal\", \"CLM\", \"machine identity\". Do NOT use for vendor-specific...Votes: 0GitHub stars: 4
- Prisma AccessExpert agent for Palo Alto Networks Prisma Access and SASE. Covers ZTNA 2.0, GlobalProtect agent, cloud FWaaS, ADEM digital experience, CASB, and Prisma SD-WAN integration. WHEN: \"Prisma Access\", \"Palo Alto SASE\", \"GlobalProtect\", \"ZTNA 2.0\", \"Prisma SD-WAN\", \"ADEM\", \"Palo Alto cloud firewall\", \"Strata Cloud Manager\", \"Panorama SASE\".Votes: 0GitHub stars: 4
- Prisma CloudExpert agent for Palo Alto Prisma Cloud / Cortex Cloud CNAPP platform. Covers CSPM, CWPP Defender agents, CIEM, DSPM, code-to-cloud pipeline security, AppDNA, and Cortex XDR convergence. WHEN: \"Prisma Cloud\", \"Cortex Cloud\", \"Prisma Cloud Defender\", \"CWPP Defender\", \"AppDNA\", \"Prisma CSPM\", \"Prisma CIEM\", \"code-to-cloud\", \"Prisma IaC\", \"Prisma runtime\", \"Palo Alto cloud security\".Votes: 0GitHub stars: 4
- ProofpointExpert agent for Proofpoint Email Protection. Covers SEG, Targeted Attack Protection, URL Defense, Very Attacked People, TRAP post-delivery remediation, and email DLP. WHEN: \"Proofpoint\", \"Proofpoint SEG\", \"TAP\", \"Targeted Attack Protection\", \"URL Defense\", \"TRAP\", \"Nexus People Risk\", \"Very Attacked People\", \"VAP\", \"Proofpoint quarantine\", \"Proofpoint DLP\".Votes: 0GitHub stars: 4
- Purview DlpExpert agent for Microsoft Purview DLP. Covers sensitive info types, trainable classifiers, exact data match, endpoint DLP, M365 policy configuration, Adaptive Protection, Copilot/AI Hub leak prevention, and Activity Explorer. WHEN: \"Purview DLP\", \"M365 DLP\", \"sensitivity labels\", \"trainable classifier\", \"exact data match\", \"endpoint DLP\", \"compliance portal\", \"Activity Explorer\", \"Copilot DLP\", \"MIP\".Votes: 0GitHub stars: 4
- QradarExpert agent for IBM QRadar SIEM. Provides deep expertise in AQL query development, offense management, DSM configuration, event pipeline tuning, custom rule building, reference sets/maps, Ariel database, and on-premises deployment architecture. WHEN: \"QRadar\", \"AQL\", \"Ariel query\", \"QRadar offense\", \"DSM\", \"QRadar rule\", \"building block\", \"reference set\", \"QRadar tuning\", \"IBM SIEM\".Votes: 0GitHub stars: 4
- QualysExpert agent for Qualys VMDR, TotalCloud, and the Qualys Cloud Platform. Covers Cloud Agent, scanner appliances, QQL, asset groups, TruRisk scoring, VMDR workflows, TotalCloud CNAPP, WAS, and Policy Compliance. WHEN: \"Qualys\", \"VMDR\", \"QQL\", \"Qualys Cloud Agent\", \"TruRisk\", \"TotalCloud\", \"Qualys scanner appliance\", \"Qualys CSAM\", \"Qualys WAS\", \"CSAM\".Votes: 0GitHub stars: 4
- Rapid7Expert agent for Rapid7 InsightVM. Covers console and distributed scan engine architecture, Insight Agent, Active Risk scoring, Remediation Hub, asset groups, SQL-like query for assets, dashboards, Metasploit integration, and InsightConnect SOAR automation. WHEN: \"Rapid7\", \"InsightVM\", \"Nexpose\", \"Insight Agent\", \"Active Risk\", \"Remediation Hub\", \"scan engine\", \"InsightConnect\", \"Rapid7 dashboard\".Votes: 0GitHub stars: 4
- Recorded FutureExpert agent for Recorded Future Intelligence Cloud. Covers Collective Insights AI/NLP analysis, Intelligence Cards, risk scoring, Identity Intelligence, Vulnerability Intelligence, Brand Intelligence, SIEM/SOAR integration, and the RF browser extension. WHEN: \"Recorded Future\", \"RF\", \"Intelligence Card\", \"Collective Insights\", \"risk score\", \"RF Portal\", \"Recorded Future API\", \"RF Intelligence\", \"Mastercard threat intel\".Votes: 0GitHub stars: 4
- RubrikExpert agent for Rubrik Security Cloud and CDM. Covers immutable filesystem, anomaly detection, threat hunting with YARA/IOCs, data classification, orchestrated recovery, Polaris GPS policy management, and ransomware resilience. WHEN: \"Rubrik\", \"CDM\", \"Rubrik Cloud Data Management\", \"Polaris\", \"Rubrik Security Cloud\", \"Live Mount\", \"threat hunting\", \"anomaly detection\", \"Rubrik cluster\", \"data classification\".Votes: 0GitHub stars: 4
- SailpointExpert agent for SailPoint IdentityNow and Atlas platform. Provides deep expertise in identity governance, access certifications, lifecycle management, role mining, SOD policies, provisioning connectors, and IdentityAI risk scoring. WHEN: \"SailPoint\", \"IdentityNow\", \"IGA\", \"access certification\", \"role mining\", \"separation of duties\", \"SOD\", \"entitlement management\", \"SailPoint Atlas\", \"IdentityAI\", \"access request\".Votes: 0GitHub stars: 4
- SastExpert routing agent for Static Application Security Testing (SAST). Covers code scanning fundamentals, taint analysis, CI/CD integration patterns, and quality gate design. Routes to SonarQube, Checkmarx, Semgrep, Snyk Code, and Veracode. WHEN: \"SAST\", \"static analysis\", \"code scanning\", \"taint analysis\", \"security hotspot\", \"false positive tuning\", \"CI security gate\", \"IDE security plugin\", \"custom security rules\". Do NOT use for tool-specific questions -- use the `sonarqub...Votes: 0GitHub stars: 4
- ScaExpert routing agent for Software Composition Analysis (SCA). Covers open source vulnerability management, CVE/CVSS scoring, license compliance, SBOM generation, reachability analysis, and dependency update automation. Routes to Snyk OSS, Dependabot, Mend, and Black Duck. WHEN: \"SCA\", \"software composition analysis\", \"open source vulnerabilities\", \"dependency scanning\", \"CVE\", \"SBOM\", \"license compliance\", \"supply chain security\", \"transitive dependencies\", \"dependency upda...Votes: 0GitHub stars: 4
- SecretsRouting agent for Secrets & Certificate Management. Delegates to specialist agents for HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, CyberArk, Doppler, Infisical, 1Password, SOPS, and PKI/certificate tooling. WHEN: \"secrets management\", \"secret rotation\", \"certificate management\", \"PKI\", \"key vault\", \"HSM\", \"envelope encryption\", \"credential storage\". Do NOT use for platform-specific questions -- use the `vault`, `azure-key-vault`, `aws-secrets`, `cyberark`, `doppler`...Votes: 0GitHub stars: 4
- SemgrepExpert agent for Semgrep static analysis. Covers rule syntax (patterns, metavariables, taint tracking), custom rule authoring, autofix, Semgrep Supply Chain, Semgrep Secrets, CI/CD integration, and Semgrep Cloud. WHEN: \"Semgrep\", \"semgrep rule\", \"semgrep pattern\", \"metavariable\", \"semgrep-action\", \"semgrep supply chain\", \"semgrep secrets\", \"custom SAST rule\", \"SARIF\", \"semgrep scan\".Votes: 0GitHub stars: 4
- Sentinel PlaybooksExpert agent for Microsoft Sentinel Playbooks (Azure Logic Apps). Provides deep expertise in automation rules, Logic Apps designer, incident/entity triggers, 200+ connectors, managed identity authentication, ARM templates, and cost-effective automation patterns for Sentinel incidents. WHEN: \"Sentinel playbook\", \"Logic Apps security\", \"automation rule\", \"Sentinel automation\", \"incident trigger\", \"entity trigger\", \"Sentinel SOAR\", \"Logic App connector\".Votes: 0GitHub stars: 4
- SentinelExpert agent for Microsoft Sentinel. Provides deep expertise in KQL query development, analytics rules, ASIM normalization, data connectors, UEBA, automation rules, playbooks, content hub, multi-workspace architecture, and cost optimization with log tiers. WHEN: \"Sentinel\", \"Microsoft Sentinel\", \"KQL\", \"analytics rule\", \"ASIM\", \"Fusion\", \"UEBA\", \"content hub\", \"Sentinel playbook\", \"Defender portal\", \"Log Analytics workspace\".Votes: 0GitHub stars: 4
- SentineloneExpert agent for SentinelOne Singularity EDR platform. Covers Storyline technology, autonomous response, 1-click rollback, Deep Visibility threat hunting, Purple AI, Ranger network discovery, and STAR rules. WHEN: \"SentinelOne\", \"Singularity\", \"Storyline\", \"Deep Visibility\", \"Purple AI\", \"1-click rollback\", \"Ranger\", \"STAR rule\", \"S1 agent\".Votes: 0GitHub stars: 4
- Servicenow GrcExpert agent for ServiceNow GRC (IRM). Covers Risk Management, Policy and Compliance Management, Audit Management, Vendor Risk Management, Continuous Authorization and Monitoring, integration with ITSM/SecOps, and Now Platform configuration. WHEN: \"ServiceNow GRC\", \"ServiceNow IRM\", \"ServiceNow risk\", \"ServiceNow compliance\", \"ServiceNow audit\", \"Now Platform GRC\", \"ServiceNow vendor risk\", \"Policy and Compliance ServiceNow\".Votes: 0GitHub stars: 4
- SiemRouting agent for SIEM & SOAR technologies. Cross-platform expertise in log management, event correlation, detection engineering, normalization, SIGMA rules, and security orchestration. WHEN: \"SIEM comparison\", \"which SIEM\", \"log management\", \"detection engineering\", \"SIGMA rules\", \"security analytics\", \"correlation rules\", \"SOAR platform\", \"security automation\", \"alert triage\". Do NOT use for platform-specific questions -- use the `splunk`, `sentinel`, `elastic-security`,...Votes: 0GitHub stars: 4
- SmallstepExpert agent for smallstep step-ca and step CLI. Covers lightweight internal PKI, OIDC-based certificate issuance, short-lived certificates, SSH certificates (user and host), Kubernetes integration, ACME support, and zero-trust patterns. WHEN: \"smallstep\", \"step-ca\", \"step CLI\", \"step certificate\", \"SSH certificate authority\", \"OIDC certificate\", \"short-lived cert\", \"step-ca ACME\", \"step-ca Kubernetes\".Votes: 0GitHub stars: 4
- SnortExpert agent for Snort 3 IDS/IPS. Covers Snort 3 architecture (inspectors, codecs, DAQ), rule syntax with sticky buffers and service keyword, OpenAppID, hyperscan, Talos rule updates, and migration from Snort 2. WHEN: \"Snort\", \"Snort 3\", \"Snort rule\", \"Talos rules\", \"OpenAppID\", \"DAQ\", \"Snort inspector\", \"snort.lua\", \"Snort 2 migration\", \"hyperscan\".Votes: 0GitHub stars: 4
- Snyk CodeExpert agent for Snyk Code AI-powered SAST. Covers DeepCode engine, real-time IDE scanning, data-flow analysis, auto-fix suggestions, Priority Score, and Snyk platform integration. WHEN: \"Snyk Code\", \"Snyk SAST\", \"DeepCode\", \"Snyk IDE plugin\", \"snyk code test\", \"Snyk Priority Score\", \"Snyk fix\", \"Snyk AppRisk\".Votes: 0GitHub stars: 4
- Snyk OssExpert agent for Snyk Open Source SCA. Covers vulnerability detection, auto-fix PRs, license compliance, reachability analysis, SBOM generation, Snyk CLI, CI/CD integration, and the Snyk platform ecosystem. WHEN: \"Snyk Open Source\", \"Snyk OSS\", \"snyk test\", \"snyk monitor\", \"snyk fix\", \"Snyk auto-fix\", \"Snyk license compliance\", \"Snyk vulnerability database\", \"snyk-to-html\".Votes: 0GitHub stars: 4
- SnykExpert agent for Snyk developer security platform. Covers Snyk Code (SAST), Snyk Open Source (SCA), Snyk Container, Snyk IaC, Snyk AppRisk (ASPM), IDE plugins, CLI, CI/CD integration, and auto-fix PRs. WHEN: \"Snyk\", \"Snyk Code\", \"Snyk Open Source\", \"Snyk Container\", \"Snyk IaC\", \"SCA\", \"dependency scanning\", \"Snyk CLI\", \"auto-fix PR\", \"AppRisk\".Votes: 0GitHub stars: 4
- SoarRouting agent for SOAR (Security Orchestration, Automation, and Response) platforms. Cross-platform expertise in playbook design, integration architecture, automation strategy, and SOAR platform comparison. WHEN: \"SOAR comparison\", \"which SOAR\", \"playbook design\", \"security automation\", \"orchestration platform\", \"automated response\", \"SOAR strategy\", \"SOAR integration\", \"automation maturity\". Do NOT use for platform-specific questions -- use the `xsoar`, `splunk-soar`, `sent...Votes: 0GitHub stars: 4
- SonarqubeExpert agent for SonarQube and SonarCloud. Covers quality gates, quality profiles, Clean Code taxonomy, SonarScanner setup, branch analysis, PR decoration, Security Hotspots, taint analysis, and OWASP/CWE mappings. WHEN: \"SonarQube\", \"SonarCloud\", \"SonarLint\", \"quality gate\", \"quality profile\", \"sonar-project.properties\", \"SonarScanner\", \"Security Hotspot\", \"new code period\", \"clean code\".Votes: 0GitHub stars: 4
- SophosExpert agent for Sophos Intercept X EDR. Covers deep learning malware detection, CryptoGuard anti-ransomware, exploit prevention, Adaptive Attack Protection, Sophos Central management, Sophos MDR service, and EDR/XDR capabilities. WHEN: \"Sophos\", \"Intercept X\", \"Sophos Central\", \"CryptoGuard\", \"Sophos EDR\", \"Sophos MDR\", \"deep learning detection\", \"Sophos XDR\", \"Sophos MTR\".Votes: 0GitHub stars: 4
- SopsExpert agent for Mozilla SOPS (Secrets OPerationS). Covers file encryption (YAML/JSON/ENV/INI), AWS KMS, GCP KMS, Azure Key Vault, age, and PGP backends, partial file encryption, GitOps patterns, and Flux/ArgoCD integration. WHEN: \"SOPS\", \"Mozilla SOPS\", \"sops encrypt\", \"sops decrypt\", \"GitOps secrets\", \"age encryption\", \"SOPS ArgoCD\", \"SOPS Flux\", \"encrypted yaml git\".Votes: 0GitHub stars: 4
- Splunk EsSplunk Enterprise Security (ES), the premium SIEM app on top of Splunk: correlation searches, notable events, risk-based alerting (RBA), MITRE ATT&CK framework mapping, adaptive response actions, asset/identity correlation, threat intelligence framework, and ES content management. WHEN: \"Splunk ES\", \"Enterprise Security\", \"notable events\", \"risk-based alerting\", \"RBA\", \"correlation search\", \"adaptive response\", \"glass tables\", \"investigation workbench\", \"ES content update\"...Votes: 0GitHub stars: 4
- Splunk SoarExpert agent for Splunk SOAR (formerly Phantom). Provides deep expertise in visual playbook development, 300+ apps with 2,800+ actions, container-based incident architecture, case management, custom app development, and Splunk Enterprise Security integration. WHEN: \"Splunk SOAR\", \"Phantom\", \"Splunk playbook\", \"SOAR app\", \"Splunk SOAR container\", \"Phantom playbook\", \"Splunk automation\", \"SOAR visual editor\".Votes: 0GitHub stars: 4
- SplunkSplunk as a SIEM/security platform across all versions (9.x-10.x): SPL query development for security detection, indexer/search head architecture, forwarder management, SmartStore, CIM normalization for security data models, knowledge objects, and deployment at scale. WHEN: \"Splunk\", \"SPL\", \"search head\", \"indexer\", \"forwarder\", \"SmartStore\", \"Splunkbase\", \"props.conf\", \"transforms.conf\", \"data model\", \"saved search\". Do NOT use for general log/metrics observability, IT ...Votes: 0GitHub stars: 4