dfir-agentic-suite

Agentic DFIR orchestrator that autonomously investigates security incidents by chaining forensic skills (IOC extraction, Windows artifact triage, timeline correlation, YARA generation) with an autonomous reasoning loop, persistent case state, and human-in-the-loop approvals. Use this skill whenever the user mentions 'investigate', 'triage this incident', 'analyze this case', 'run a full investigation', 'what happened on this system', or asks for autonomous forensic analysis. Also triggers when multiple DFIR skills need to be chained together, when the user provides KAPE output or log files and wants comprehensive analysis, or when an alert needs end-to-end triage. This is the master orchestrator — it decides which sub-skills to invoke and in what order.

Extract and enrich Indicators of Compromise (IOCs) from any input — log files, alerts, emails, pastes, forensic tool output, threat intel reports, or raw text. Extracts IPs, domains, URLs, file hashes (MD5/SHA1/SHA256), email addresses, CVE IDs, Bitcoin/Ethereum addresses, MITRE ATT&CK technique IDs, and Windows-specific artifacts (registry paths, named pipes, service names). Enrichment via VirusTotal, AbuseIPDB, Shodan, OTX when API keys are available. Use this skill whenever the user mentions IOCs, indicators, observables, enrichment, reputation checks, or asks to 'extract indicators from', 'check this hash', 'enrich these IPs', 'defang/refang', or 'what IOCs are in this file'. Also triggers for triage workflows needing IOC context.

Parse, normalize, and correlate forensic timelines from Plaso/log2timeline (l2tcsv, json_line), Hayabusa (CSV/JSONL), Chainsaw (JSON), and raw log files (syslog, auth.log, JSON-formatted logs, Windows XML event logs). Produces unified UTC timelines, detects attack sequences, and maps findings to MITRE ATT&CK. Use this skill whenever the user mentions timeline, plaso, log2timeline, supertimeline, l2tcsv, timeline correlation, log parsing, attack sequence, 'merge these logs', 'correlate events across sources', 'build a timeline', 'what happened between', or 'reconstruct the attack'. Also triggers for temporal analysis, time-window queries, and gap detection in forensic timelines.

Parse and correlate Windows forensic artifacts from EZTools (Eric Zimmerman), KAPE, Chainsaw, Hayabusa, and raw event logs. Handles CSV output from EvtxECmd, MFTECmd, PECmd (Prefetch), AmcacheParser, AppCompatCacheParser, SBECmd (ShellBags), LECmd (LNK files), JLECmd (Jump Lists), and RECmd (Registry). Also parses Chainsaw JSON and Hayabusa CSV/JSONL timelines. Use this skill whenever the user mentions Windows forensics, EZTools, KAPE output, event logs, prefetch, amcache, shimcache, MFT, USN journal, registry forensics, shellbags, Chainsaw, Hayabusa, or asks to 'parse these artifacts', 'triage this Windows system', 'correlate these events', 'what executed on this system', 'find persistence', or 'build a timeline from KAPE'. Also triggers for lateral movement analysis, evidence of execution, and timestomping detection.

Generate YARA rules from behavioral descriptions, malware samples, forensic findings, or threat intelligence reports. Produces well-structured YARA rules with metadata, string patterns, and conditions. Supports PE-specific features (imports, exports, sections, imphash), magic byte detection, and condition logic. Can also analyze existing YARA rules for quality, convert between YARA and Sigma where applicable, and generate rules from IOC lists. Use this skill whenever the user mentions YARA, detection rules, 'write a rule for', 'detect this malware', 'create a signature', 'generate YARA from', 'improve this YARA rule', or any request involving malware detection signatures. Also triggers when analyzing pefile output, strings output, or malware behavior reports that could be converted to detection rules.