willwebster5
- 10 skills
- 0 followers
- 9 hours ago last updated
- ▌ Cql Patterns · willwebster5 bundleCQL pattern catalog — curated detection engineering patterns for CrowdStrike NG-SIEM. Use when writing, reviewing, or debugging CQL queries.
- ▌ Threat Hunting · willwebster5 bundleAutonomous threat hunting using the PEAK framework (Prepare → Execute → Act). Executes hypothesis-driven, intelligence-driven, and baseline hunts against CrowdStrike NG-SIEM. Produces hunt reports, detection backlogs, and visibility gap reports. Use when proactively hunting for threats, validating detection coverage, or responding to new threat intelligence.
- ▌ Detection Tuning · willwebster5 bundleAnalyze CrowdStrike NGSIEM detections for tuning opportunities based on environmental context, recent false positives, and available enrichment functions. Use when tuning detections (including behavioral rules with correlate()), reducing false positives, enhancing detection coverage, or reviewing OOTB templates for production deployment.
- ▌ Fusion Workflows · willwebster5 bundleBuild CrowdStrike Falcon Fusion SOAR workflows. Discover actions via live API, author YAML using our resource schema, validate locally, and save to resources/workflows/. Use when asked to create a Fusion workflow, SOAR playbook, or automate detection response.
- ▌ Response Playbooks · willwebster5Detection-to-response mapping and SOAR playbook design. Analyzes detections, recommends tiered response actions (observe, investigate, contain, remediate), and produces handoff docs for fusion-workflows to generate workflow YAML. Use when planning response automation for detections, designing SOAR playbooks, or mapping detections to Falcon Fusion workflow actions.
- ▌ Behavioral Detections · willwebster5 bundleDesign multi-event behavioral detection rules using CrowdStrike NG-SIEM correlate() function. Use when building attack chain detections, correlating multiple events across time windows, or creating behavioral rules that detect complex threat patterns across AWS, EntraID, and CrowdStrike data sources.
- ▌ Source Threat Modeling · willwebster5Threat-model-first detection planning for data sources without OOTB coverage. Analyzes what threats apply to a source type, validates against live log data, and produces a prioritized detection backlog with handoff docs for authoring skills. Use when onboarding a new data source, planning detection coverage for a source without OOTB templates, or assessing what threats a source can detect.
- ▌ Logscale Security Queries · willwebster5 bundleDevelop, optimize, and troubleshoot CrowdStrike LogScale (Humio) security detection queries using CQL syntax. Use when writing LogScale queries, building security detections, creating threat hunting rules, fixing CQL syntax errors, working with CrowdStrike EDR/Falcon security monitoring, or building behavioral rules with the correlate() function. Handles case statements, risk categorization, multi-event correlation, investigation playbooks, and actionable security outputs.
- ▌ Soc · willwebster5 bundleUnified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Use when triaging alerts, investigating detections, running daily SOC review, or tuning for false positives.
- ▌ Soc Agents · willwebster5 bundle> SOC skill v3 loaded — agent-delegated phased architecture. Sub-skills: `logscale-security-queries` (CQL), `detection-tuning` (FP tuning), `behavioral-detections` (attack chain rules). Agents: `alert-formatter` (Haiku), `cql-query` (Sonnet), `mcp-investigator` (Sonnet), `evidence-summarizer` (Sonnet), `syntax-validator` (Haiku).