macos-ir
CommunityAutomate macOS intrusion checks and response.
Authorchenchunrun
Version1.0.0
Installs0
System Documentation
What problem does it solve?
macOS 入侵检查与应急响应工作流，提供统一、可重复的检测与取证入口，帮助安全团队快速识别入侵迹象并制定处置计划。
Core Features & Use Cases
- 统一入口: 通过 Velociraptor 本地模式与 VQL 查询，整合多模块检测与取证点。
- 覆盖广泛场景: 针对可疑进程、持久化机制、异常网络活动、并发出警告的系统配置进行狩猎。
- 应用场景示例: 安全运维团队在企业环境中对 macOS 终端进行快速安全评估，生成可操作的处置清单。
Quick Start
运行统一入口脚本以执行快速的 macOS 入侵检查。
Dependency Matrix
Required Modules
velociraptor
Components
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: macos-ir Download link: https://github.com/chenchunrun/onyx-soc/archive/main.zip#macos-ir Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.