Canhada-Labs

Threat Detection Engineer — Security agent for Claude Code

Security community

Principal Threat Detection Engineer with VETO authority over detection-as-code coverage, false-positive-rate drift, and SOC alert quality.

How to install Threat Detection Engineer

Installs to ~/.claude/agents/canhada-labs-ceo-orchestration-threat-detection-engineer.md

Terminal
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Canhada-Labs/ceo-orchestration/HEAD/.claude/agents/threat-detection-engineer.md -o ~/.claude/agents/canhada-labs-ceo-orchestration-threat-detection-engineer.md

Restart Claude Code, or start a new session, for it to be picked up.

What Threat Detection Engineer does

name: threat-detection-engineer description: Principal Threat Detection Engineer with VETO authority over detection-as-code coverage, false-positive-rate drift, and SOC alert quality. Loads security-and-auth skill via reference (PLAN-020 ADR-051) for the §Detection-as-Code corpus + ATT&CK / SIEM doctrine. Use for: detection rule design, MITRE ATT&CK coverage mapping, SIEM rule review, false-positive-rate audit, alert deduplication, signature drift audits, log source coverage, detection unit

Alternatives in Security

  • Dr Audit — Sub-agent prompt: audit Decision Records in an implementation-plan.md for canonical form and reference resolut 432 ★
  • Audit Verifier — Adversarially verifies one candidate finding from /bug-audit — tries to REFUTE it by reading the code and, whe 335 ★
  • General Technical Project Lead — Use this agent proactively when you need principal-level technical leadership for complex projects, performanc 248 ★

Full documentation available on GitHub

View Source Repository

Related Agents

After Confirming A Vulnerability — Security agent for Claude Code

After Confirming A Vulnerability

findings.sh update vuln --status confirmed --confirmed-by "poc-validator" \ --poc-output " " findings.sh updat

Security community
Security Triage — Security agent for Claude Code

Security Triage

Independently evaluate a single security finding to decide whether it is a real, exploitable vulnerability or

Security community
Audit Finding Verifier — Security agent for Claude Code

Audit Finding Verifier

Verifies a single reported audit finding against the actual codebase. Determines whether it is confirmed, a fa

Security community
Audit Sweep — Security agent for Claude Code

Audit Sweep

A read-only audit or survey sweep — reviewing a corpus against a stated rule and reporting what violates it, w

Security community
Infra Threat Detection — Security agent for Claude Code

Infra Threat Detection

Active alert triage and telemetry correlation. Reads SIEM alerts and the central journal, correlates across do

Security community
Engineering Threat Detection Engineer — Security agent for Claude Code

Engineering Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community

Related Skills

Skill Audit MCP — Security skill for Claude Code

Skill Audit MCP

Static security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, cal

Security community
Secure LLM Gateway — Security skill for Claude Code

Secure LLM Gateway

Security-focused gateway in front of an LLM API — auth, prompt-injection defense, output filtering, audit logg

Security community
Scraper Run — AI skill for Claude Code

Scraper Run

Deterministic extraction engine. Loads a blueprint, executes pagination, handles auth refresh, rate limits, an

AI community