Mfrostbutter

Infra Threat Detection — Security agent for Claude Code

Security community

Active alert triage and telemetry correlation.

How to install Infra Threat Detection

Installs to ~/.claude/agents/mfrostbutter-infra-ai-it-team-runbook-infra-threat-detection.md

Terminal
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Mfrostbutter/Infra-AI-IT-Team-Runbook/HEAD/agents/infra-threat-detection.md -o ~/.claude/agents/mfrostbutter-infra-ai-it-team-runbook-infra-threat-detection.md

Restart Claude Code, or start a new session, for it to be picked up.

What Infra Threat Detection does

name: infra-threat-detection description: Active alert triage and telemetry correlation. Reads SIEM alerts and the central journal, correlates across domains, generates incident hypotheses. Peer to infra-security. tools: Read, Bash, Glob, Grep, WebFetch model: sonnet

You own the active-threat triage domain.

Scope

  • SIEM alert triage at level >= 7 (or your configured threshold)
  • Telemetry correlation: alerts × journal entries × host inventory
  • Indicator analysis: file hashes, IP

Alternatives in Security

  • Vault Librarian — Run vault maintenance: detect orphan notes, find broken wikilinks, validate frontmatter completeness, flag sta 4.6k ★
  • Brain — Central knowledge coordinator 812 ★
  • Aspm Correlator — Application Security Posture Management persona 548 ★

Full documentation available on GitHub

View Source Repository

Related Agents

Engineering Threat Detection Engineer — Security agent for Claude Code

Engineering Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community
Infra Docs — Security agent for Claude Code

Infra Docs

Documentation and audit specialist. Reads the central journal, runs the scheduled drift sweep, and reconciles

Security community
SecOps Analyst — Security agent for Claude Code

SecOps Analyst

Monitors production traffic for security threats, performs incident response, and maintains security operation

Security community
Oficial De Seguranca — Security agent for Claude Code

Oficial De Seguranca

Workbench security with dual role — (a) AUDITS every external dep/repo/AI brought by the Recruiter before adop

Security community
Sovereign Filter — Security agent for Claude Code

Sovereign Filter

Decides which discovered competitors are genuinely active in UK Sovereign services (central government, defenc

Security community
Security Analyzer (Synthesizer) — Security agent for Claude Code

Security Analyzer (Synthesizer)

You consolidate findings from research agents into prioritized hypotheses.

Security community

Related Skills

Threat Detection Engineer — Security skill for Claude Code

Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community
Specter — Security skill for Claude Code

Specter

Real-time SIEM security dashboard with AI-powered alert analysis. Connects to Wazuh & Suricata.

Security community
Log Triage — Code Quality skill for Claude Code

Log Triage

Triage application logs and find the root cause fast. Multi-format parser (JSON/syslog/nginx/Python-Java stack

Code Quality community