Convert HarfangLab EDR content into CoreTide YAML with validated selectors and fields.
npx skills add https://github.com/OpenTideHQ/AgentTide --skill harfanglab
Please help me install this Agent Skill. Skill: harfanglab Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/harfanglab Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill harfanglab
This skill encodes HarfangLab EDR content authoring concepts into CoreTide's validated YAML schema, enabling consistent, machine-readable rule authoring for detection engineering.
Describe how to generate CoreTide YAML for HarfangLab content authoring and validate the Sigma, RHQL, and YARA surfaces.
High-intent search queries and answers about installing and using this skill.
Author Sigma detection rules for HarfangLab EDR by converting them into validated CoreTide YAML. This applies structured selections, modifiers, and fields to ensure machine-readable detection content and accurate activation.
Yes, you can use YARA rules with HarfangLab for MDR ingestion. The skill formats YARA rules into CoreTide's schema, including necessary imports, meta definitions, and cross-product context for accurate detection.
HarfangLab content authoring supports RHQL hunting by generating structured queries with auto-routing. This enables efficient in-context evaluation of threats across Windows, macOS, and Linux environments.
The harfanglab::1.0 schema is a validated YAML structure for detection content. It ensures compliance by enforcing proper imports, meta, and context definitions across Sigma rules and YARA integrations.
Validate selectors and fields for CoreTide YAML by applying the harfanglab::1.0 schema. This ensures all detection rules maintain correct modifiers, imports, and context definitions for production-grade routing.
copyleftdevCreate portable YARA and Sigma threat detection rules for malware hunting.
OpenTideHQCreate deployable MDR detection rules with platform-specific metadata and cross-platform configurations.
balsm-healthAutomate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.
XerrionExtract IoCs, map MITRE ATT&CK, and author YARA/Sigma rules.
