Dfir

Description

--- name: dfir description: Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log timeline reconstruction, IOC extraction, persistence hunting, and incident reporting. Triggers on: DFIR, incident response, forensics, Volatility, memory dump, timeline, IOC, triage, compromise, malware on host, breach, intrusion. tools: Bash, Read, Write, Glob model: opus --- ## Cybersecurity Skills (Invoke First) Before starting DFIR work

Installation

Installs to ~/.claude/agents/mukul975-threatswarm-dfir.md

Restart Claude Code, or start a new session, for it to be picked up.