Mfrostbutter

Infra Threat Detection — Security agent for Claude Code

Security community

Active alert triage and telemetry correlation.

How to install Infra Threat Detection

Installs to ~/.claude/agents/mfrostbutter-infra-ai-it-team-runbook-infra-threat-detection.md

Terminal
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Mfrostbutter/Infra-AI-IT-Team-Runbook/HEAD/agents/infra-threat-detection.md -o ~/.claude/agents/mfrostbutter-infra-ai-it-team-runbook-infra-threat-detection.md

Restart Claude Code, or start a new session, for it to be picked up.

What Infra Threat Detection does

name: infra-threat-detection description: Active alert triage and telemetry correlation. Reads SIEM alerts and the central journal, correlates across domains, generates incident hypotheses. Peer to infra-security. tools: Read, Bash, Glob, Grep, WebFetch model: sonnet

You own the active-threat triage domain.

Scope

  • SIEM alert triage at level >= 7 (or your configured threshold)
  • Telemetry correlation: alerts × journal entries × host inventory
  • Indicator analysis: file hashes, IP

Alternatives in Security

  • Vault Librarian — Run vault maintenance: detect orphan notes, find broken wikilinks, validate frontmatter completeness, flag sta 4.6k ★
  • Brain — Central knowledge coordinator 812 ★
  • Aspm Correlator — Application Security Posture Management persona 548 ★

Full documentation available on GitHub

View Source Repository

Related Agents

Engineering Threat Detection Engineer — Security agent for Claude Code

Engineering Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community
Infra Docs — Security agent for Claude Code

Infra Docs

Documentation and audit specialist. Reads the central journal, runs the scheduled drift sweep, and reconciles

Security community
Oficial De Seguranca — Security agent for Claude Code

Oficial De Seguranca

Workbench security with dual role — (a) AUDITS every external dep/repo/AI brought by the Recruiter before adop

Security community
Infra Security — Security agent for Claude Code

Infra Security

Security triage and hardening specialist. Exposure review, IR coordination, hardening recommendations. Recomme

Security community
Sovereign Filter — Security agent for Claude Code

Sovereign Filter

Decides which discovered competitors are genuinely active in UK Sovereign services (central government, defenc

Security community
Security Analyzer (Synthesizer) — Security agent for Claude Code

Security Analyzer (Synthesizer)

You consolidate findings from research agents into prioritized hypotheses.

Security community

Related Skills

Review Observability — Security skill for Claude Code

Review Observability

Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code

Security community
Hatch3r Bug Plan — Design skill for Claude Code

Hatch3r Bug Plan

Diagnose a complex incident -- reproduce the symptom, rank root-cause hypotheses, design the fix path, and emi

Design community
Google Workspace Alert Center — Security skill for Claude Code

Google Workspace Alert Center

Manage security alerts

Security community