norandom/investigation-theory
v1.0.1
Guide SOC and DFIR investigations with Investigation Theory's Diagnostic Inquiry workflow. Use for alert triage, evidence and log analysis, phishing, lateral movement, C2, malware, exfiltration, and insider cases. Produces case notes, playbooks, timelines, dispositions, compromise reports, and review diagrams. Excludes detection engineering and offensive work.
plugin.json
- name
- investigation-theory
- version
- 1.0.1
- description
- Guide SOC and DFIR investigations with Investigation Theory's Diagnostic Inquiry workflow. Use for alert triage, evidence and log analysis, phishing, lateral movement, C2, malware, exfiltration, and insider cases. Produces case notes, playbooks, timelines, dispositions, compromise reports, and review diagrams. Excludes detection engineering and offensive work.
- author
- norandomhttps://github.com/norandom
- repository
- https://github.com/norandom/Skills
- keywords
- dfirsocincident-response
plugin.json
{
"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
"name": "investigation-theory",
"version": "1.0.1",
"description": "Guide SOC and DFIR investigations with Investigation Theory's Diagnostic Inquiry workflow. Use for alert triage, evidence and log analysis, phishing, lateral movement, C2, malware, exfiltration, and insider cases. Produces case notes, playbooks, timelines, dispositions, compromise reports, and review diagrams. Excludes detection engineering and offensive work.",
"author": {
"name": "norandom",
"url": "https://github.com/norandom"
},
"homepage": "https://github.com/norandom/Skills/tree/main/investigation-theory",
"repository": "https://github.com/norandom/Skills",
"keywords": ["dfir","soc","incident-response"]
}
What else this package ships
These files come with the package and this site does not publish them. They are listed so you know what is there before you install it.
- evals.json