Correlate security events from logs to reveal intrusion traces.
npx skills add https://github.com/Q16G/aster --skill intrusion-detection
Please help me install this Agent Skill. Skill: intrusion-detection Source: https://github.com/Q16G/aster/tree/main/skills/host-defense/intrusion-detection Command: npx skills add https://github.com/Q16G/aster --skill intrusion-detection
本技能通过对主机日志进行自动化分析，检测入侵迹象、重建攻击时间线，并为事件响应提供证据材料。
在提供的日志数据集上运行入侵检测工作流，识别潜在入侵并给出后续步骤。
High-intent search queries and answers about installing and using this skill.
To detect an intrusion from server logs, the Skill correlates authentication, process, and network events to identify suspicious activities and reveal traces of unauthorized access.
Yes, you can reconstruct an attack timeline from host log analysis by aggregating correlated security events into a chronological view to support incident response and forensics.
The best way to map attacks during incident response is to correlate observed indicators across host endpoints, generating structured timelines and containment guidance for remediation.
Yes, you need structured data access and reliable data sources for threat hunting on endpoints, as strict validation of inputs and outputs is required to ensure deterministic behavior.
Yes, this log analysis approach provides remediation suggestions, offering specific containment and remediation guidance based on the observed indicators of compromise detected during the analysis.
tekgruntCollect forensic artifacts from endpoints via D&R rules.
UnitOneAIGenerate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.
pauljbernardCoordinate cyber threat analysis, intelligence collection, and incident response.
zangxin75Monitors Clawdbot deployments for intrusions and anomalous credential usage.
