cyber-defense-team

Coordinate four agents to analyze security logs and generate incident reports.

37|4|Updated Feb 16, 2026

Search Tags:#automation #multi-agent #anomaly-detection #log-analysis #risk-classification #incident-report #cyber-security

Ready to run

npx skills add https://github.com/FlorianBruniaux/claude-code-plugins --skill cyber-defense-team-florianbruniaux

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cyber-defense-team
Source: https://github.com/FlorianBruniaux/claude-code-plugins/tree/main/plugins/security-suite/skills/cyber-defense-team
Command: npx skills add https://github.com/FlorianBruniaux/claude-code-plugins --skill cyber-defense-team-florianbruniaux

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Orchestrate a 4-agent cyber defense pipeline to analyze log files for threats. Use when investigating security logs, detecting anomalies in access patterns, classifying breach severity, or generating incident reports from nginx/auth/syslog files.

Core Features & Use Cases

Orchestrates a four-agent pipeline: log-ingestor, anomaly-detector, risk-classifier, threat-reporter to process logs and produce structured outputs.
Detects anomalies, classifies risk, and compiles an incident report from nginx/auth/syslog data.
Use case: security operations center monitoring or post-incident analysis to generate a comprehensive report.

Quick Start

Run the cyber-defense-team on a log file path to start ingestion, analysis, and report generation.

Frequently Asked Questions about cyber-defense-team

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security log analysis for nginx and syslog files?▼

Automating security log analysis involves processing nginx, auth, and syslog files to detect anomalies and classify risks. A four-agent pipeline—comprising log-ingestor, anomaly-detector, risk-classifier, and threat-reporter—orchestrates this end-to-end to produce structured JSON outputs and a final incident report.

Can I generate automated incident reports from auth log anomalies?▼

Yes, you can generate incident reports from auth log anomalies. By ingesting the logs and detecting access pattern anomalies, a risk classifier evaluates breach severity, allowing a threat-reporter agent to automatically compile a comprehensive incident report.

What is a multi-agent pipeline for cyber defense log analysis?▼

A multi-agent cyber defense pipeline is an orchestrated workflow where specialized agents handle distinct tasks: ingesting logs, detecting anomalies, classifying risk severity, and generating reports. This automates threat detection and incident response for security operations.

Does multi-agent anomaly detection work for post-incident breach analysis?▼

Yes, multi-agent anomaly detection works for post-incident breach analysis. The pipeline processes historical security logs to identify anomalies, classify the severity of past breaches, and compile a comprehensive report detailing the incident.

How do I classify cyber security risk from syslog data?▼

To classify cyber security risk from syslog data, a risk-classifier agent evaluates detected anomalies within the logs. This automated classification determines the severity of potential breaches before passing the results to a threat-reporter for final documentation.

What is the best way to coordinate a 4-agent cyber defense team?▼

The best way to coordinate a 4-agent cyber defense team is through an automated orchestration pipeline that sequentially processes logs. The agents—log-ingestor, anomaly-detector, risk-classifier, and threat-reporter—pass structured outputs to each other to produce a final report.