cybersecurity-analyst

Model threats and develop hunting hypotheses aligned to MITRE ATT&CK techniques.

6|Updated May 20, 2026

Search Tags:#cybersecurity #incident-response #dfir #threat-hunting #threat-intelligence #mitre-attack

Ready to run

npx skills add https://github.com/vignesh2027/Claude-Agentic-Skills2.0-version --skill cybersecurity-analyst-vignesh2027

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cybersecurity-analyst
Source: https://github.com/vignesh2027/Claude-Agentic-Skills2.0-version/tree/main/cybersecurity-analyst
Command: npx skills add https://github.com/vignesh2027/Claude-Agentic-Skills2.0-version --skill cybersecurity-analyst-vignesh2027

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CybersecurityAnalyst activates advanced threat detection, hunting, and incident response workflows using MITRE ATT&CK guidance to help security teams model threats, develop hypotheses, and coordinate DFIR investigations.

Core Features & Use Cases

MITRE ATT&CK-aligned threat modeling and mapping of indicators to tactics and techniques.
Threat hunting hypothesis development and query writing to surface anomalous activity.
DFIR investigation guidance, threat intelligence analysis, and SOC playbook design for incident response workflows.

Quick Start

Describe your incident scenario and request an ATT&CK-aligned threat-hunting plan.

Frequently Asked Questions about cybersecurity-analyst

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I develop a threat hunting hypothesis using MITRE ATT&CK techniques?▼

Threat hunting hypotheses are developed by mapping anomalous enterprise network activity to specific MITRE ATT&CK techniques and tactics. This approach provides structured analyses and reproducible queries to surface hidden threats.

What is the best way to map incident indicators to MITRE ATT&CK tactics?▼

Mapping incident indicators to MITRE ATT&CK tactics involves aligning detected threats with standardized defense outcomes. This provides structured threat models that connect specific indicators directly to attacker behaviors.

How do I design a SOC playbook for incident response workflows?▼

Designing a SOC playbook for incident response requires applying DFIR investigation guidance and threat intelligence analysis. This standardizes incident response workflows across enterprise environments for rapid threat coordination.

Can I use this approach for DFIR investigations across enterprise environments?▼

Yes, applying DFIR guidance across enterprise environments helps coordinate investigations and model threats effectively. It delivers standardized threat models mapped directly to ATT&CK techniques and defense outcomes.

Does threat modeling with ATT&CK work for developing reproducible hunting queries?▼

Threat modeling with ATT&CK works for hunting by generating structured analyses and reproducible queries. These queries target anomalous activity based on developed hypotheses aligned with known attacker techniques.