Luke FitzGerald
Community@lukefitzg
Luke FitzGerald maintains a 16-skill knowledge base for TinySocs, a Windows detection-content platform covering rule engineering, Atomic Red Team validation, and signed-pack operations.
Agent Skills by Luke FitzGerald
Showing 16 vetted skills indexed across 1 GitHub repositories.
lukefitzgtinysocs-research-frontier
Catalogues TinySocs's seven unbuilt subsystems with verified repo evidence and actionable first steps.
lukefitzgtinysocs-run-and-operate
Installs, runs, and operates TinySocs SIEM services on Windows hosts.
lukefitzgtinysocs-docs-and-writing
Resolves documentation drift and enforces writing rules across TinySocs design docs and rule docs.
lukefitzgtinysocs-config-and-flags
Documents every TinySocs config file, environment variable, and default across the C# agent and Python services.
lukefitzgtinysocs-validation-and-qa
Defines evidence standards for validating TinySocs detection rules via xUnit tests and Atomic Red Team harness.
lukefitzgtinysocs-detection-validation-toolkit
Validates TinySocs detection rules end-to-end via xUnit tests and Atomic Red Team harness runs.
lukefitzgtinysocs-debugging-playbook
Diagnose TinySocs failures with symptom-to-cause triage tables and verified fix pointers.
lukefitzgtinysocs-failure-archaeology
Chronicles TinySocs repository failure history with verified commit SHAs, root causes, and statuses.
lukefitzgtinysocs-validation-publication-campaign
Repairs and republishes TinySocs validation pipeline results across dashboards, packs, and weekly runs.
lukefitzgtinysocs-architecture-contract
Documents verified load-bearing design invariants and weak points of the TinySocs detection architecture.
lukefitzgtinysocs-external-positioning
Validates TinySocs customer-facing copy against approved claims, rule counts, and pricing rules.
lukefitzgtinysocs-build-and-env
Rebuild TinySocs components from a clean checkout across C#, Python, and Inno Setup toolchains.
lukefitzgdetection-engineering-reference
Documents Windows event IDs, detection rule semantics, and MITRE mappings for TinySocs.
lukefitzgtinysocs-diagnostics-and-tooling
Verify TinySocs SIEM health, alert pipeline, ledger integrity, and retention with diagnostic tooling.
lukefitzgtinysocs-research-methodology
Guides enable, disable, and tuning decisions for TinySocs detection rules using evidence-based judgment.
lukefitzgtinysocs-change-control
Gates TinySocs changes through pivot-alignment checks, change-class rules, and a pre-merge checklist.
Frequently Asked Questions About Luke FitzGerald
FAQPage SchemaWhat tasks can I accomplish with Luke FitzGerald's TinySocs skills?▼
The 16 skills cover the full TinySocs lifecycle: authoring and validating detection rules against Atomic Red Team, installing and operating the Windows agent and OpenSearch stack, debugging known failure modes, auditing config defaults, rebuilding from clean checkouts, and governing public-facing rule counts and efficacy claims.
Who are these TinySocs skills designed for?▼
Detection engineers, security operators, and the solo maintainer working on the TinySocs detection-content-as-a-service pivot. They serve anyone enabling or tuning rules, running validation campaigns, writing customer-facing positioning, or deciding whether a change passes the change-control gate.
How do I install and run TinySocs using these skills?▼
The tinysocs-run-and-operate skill documents the Inno Setup Quickstart.iss flow, the TinySocs.Installer.psm1 PowerShell module, NSSM-wrapped services, scheduled tasks, and retention policies. The tinysocs-diagnostics-and-tooling skill then proves the install with Test-TinySocsHealth and a 10-minute pipeline runbook.
What prerequisites and dependencies do these skills assume?▼
A Windows host or VM for the agent and installer, a macOS-primary dev topology with UNC shares, dotnet for the C# agent, Python venvs for the FastAPI services, OpenSearch indices for alerts, and ed25519 keys for signed rule packs. PowerShell 5.1 constraints and ASCII-only authoring are enforced.
How does TinySocs validate that detection rules actually fire?▼
Two independent mechanisms: xUnit synthetic-event tests in DetectionEngineTests.cs and a live Atomic Red Team harness driven by tests/atomic-tests.yaml. Rules earn harness-validated status only by clearing DETECTED thresholds; curated-vs-raw denominator discipline governs which efficacy figures may be quoted externally.