Detectives and Criminal Investigators

Protective Service Occupations · Job Skills & Competencies · SOC 33-3021 · 131 skills

Occupation context

These O*NET tasks describe the occupation. They provide context for this SOC mapping, but do not mean every listed Skill performs every task.

Check victims for signs of life, such as breathing and pulse.
Obtain facts or statements from complainants, witnesses, and accused persons and record interviews, using recording device.
Secure deceased body and obtain evidence from it, preventing bystanders from tampering with it prior to medical examiner's arrival.

O*NET task statements are shown in their source language (English). Task data excerpted from the O*NET® 29.1 Database (USDOL/ETA) and used under CC BY 4.0.

Representative sources

A bounded sample of popular skills mapped to this occupation, with at most one Skill from each GitHub repository. The complete mapped list follows.

danielmiessler/Personal_AI_Infrastructure

OSINT and people-finding — structured investigations, company intel, due diligence, and ethical people search across public records and social media. USE WHEN OSINT, due diligence, company intel, background check, find person, locate, people search, reconnect, public records, reverse lookup, social media search, verify identity, domain lookup, entity lookup, organization lookup, company lookup, threat intel.

performing-mobile-device-forensics-with-cellebrite

Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.

decompose-multimedia-source-verification

web2bigtable/Web2BigTable

A two-stage strategy to isolate specific visual or bibliographic details from social media and video content by separating source identification from contextual extraction.

root-cause-analysis-security

sethdford/claude-skills

Conduct root-cause analysis (RCA) to identify underlying causes of security incidents and prevent recurrence.

All mapped skills

Browse the complete catalog mapping by repository popularity or latest source activity.

Skill names and descriptions remain in the language supplied by their source repository.

Sort by

danielmiessler/Personal_AI_Infrastructure

OSINT and people-finding — structured investigations, company intel, due diligence, and ethical people search across public records and social media. USE WHEN OSINT, due diligence, company intel, background check, find person, locate, people search, reconnect, public records, reverse lookup, social media search, verify identity, domain lookup, entity lookup, organization lookup, company lookup, threat intel.

performing-mobile-device-forensics-with-cellebrite

Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.

decompose-multimedia-source-verification

web2bigtable/Web2BigTable

A two-stage strategy to isolate specific visual or bibliographic details from social media and video content by separating source identification from contextual extraction.

root-cause-analysis-security

sethdford/claude-skills

Conduct root-cause analysis (RCA) to identify underlying causes of security incidents and prevent recurrence.

deepfake-detection

dirnbauer/webconsulting-skills

Guides multimodal media authentication and deepfake forensics using provenance checks, metadata review, PRNU/noise analysis, temporal consistency, semantic forensics, and evidence reporting. Use when the user asks to verify images, audio, or video, investigate synthetic media, assess fake or manipulated content, or prepare a media authenticity report.

incident-responder

saeed-vayghan/gemini-agent-skills

Expert incident responder specializing in security and operational incident management. Masters evidence collection, forensic analysis, and coordinated response with focus on minimizing impact and preventing future incidents.

$refractionPOINT$ refractionPOINT/lc-ai

Velociraptor DFIR integration for LimaCharlie. List available VQL artifacts, view artifact definitions, launch forensic collections on endpoints. Find raw collection data in Artifacts (type:velociraptor, source:SID). Query processed JSON events from the 'velociraptor' sensor (tag:ext:ext-velociraptor). Build D&R rules for velociraptor_collection events. Use for: forensic triage, incident response, threat hunting, VQL artifact collection.

reuteras/dfirws

Use this skill when working in the DFIRWS Windows Sandbox to analyze artifacts with built-in tools, especially when the task mentions C:\Tools, C:\venv, C:\git, Desktop\readwrite, Desktop\readonly, or DFIR triage workflows. It provides deterministic workflows for selecting tools, running quick triage, and reporting repeatable commands.

detecting-dnp3-protocol-anomalies

Njones17/AI-agent-master-cyber-skills-list

Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.

acquiring-disk-image-with-dd-and-dcfldd

Njones17/AI-agent-master-cyber-skills-list

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

Njones17/AI-agent-master-cyber-skills-list

Discover and inventory all privileged accounts across enterprise infrastructure including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin account

performing-dmarc-policy-enforcement-rollout

Njones17/AI-agent-master-cyber-skills-list

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.