Agent skill · security · alirezarezvani
threat-detection
Use when hunting threats, sweeping IOCs or looking for anomalies in logs and telemetry. Ranks ATT&CK-mapped signals and z-score anomalies with threat_signal_analyzer.py.
Why this skill is useful
Adds a Python script for threat signal analysis that provides unique detection capabilities not commonly found in public resources.
What it needs
Requires python3 installed locally. About 8k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Threat Detection Threat detection skill for proactive discovery of attacker activity through hypothesis-driven hunting, IOC analysis, and behavioral anomaly detection. This is NOT incident response (see incident-response) or red team operations (see red-team) — this is about finding threats that have evaded automated controls. --- Table of Contents Overview Threat Signal Analyzer Threat Hunting Methodology IOC Analysis Anomaly Detection MITRE ATT&CK Signal Prioritization Deception and Honeypot Integration Workflows Anti-Patterns Cross-References --- Overview What This Skill Does This skill provides the methodology and tooling for proactive threat detection — finding attacker activity through structured hunting hypotheses, IOC analysis, and statistical anomaly detection before alerts fire. Distinction from Other Security Skills Skill Focus Approach ------- ------- ---------- threat-detection (this) Finding hidden threats Proactive — hunt before alerts incident-response Active incidents Reactive — contain and investigate declared incidents red-team Offensive simulation Offensive — test defenses from attacker perspective cloud-security Cloud misconfigurations Posture — IAM, S3, network exposure Prerequisites Read access to SIEM/EDR telemetry, endpoint logs, and network flow data. IOC feeds require freshness within 30 days to avoid false positives. Hunting hypotheses must be scoped to the environment before execution. --- Threat Signal Analyzer The threatsignalanalyzer.py tool supports three modes: hunt (hypothesis scoring), ioc (sweep generation), and anomaly (statistical detection). IOC file format Telemetry events file format Exit codes Code Meaning ------ --------- 0 No high-priority findings 1 Medium-priority signals detected 2 High-priority confirmed findings --- Threat Hunting Methodology Structured threat hunting follows a five-step loop: hypothesis → data source identification → query execution → finding triage → feedback to detection engineering. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/threat-detection--a51bc0