Wh4l3X

Detection Engineer — Security agent for Claude Code

Security community

Delegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating detect.

How to install Detection Engineer

Installs to ~/.claude/agents/wh4l3x-claude-code-pentest-arsenal-detection-engineer.md

Terminal
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Wh4l3X/claude-code-pentest-arsenal/HEAD/agents/detection-engineer.md -o ~/.claude/agents/wh4l3x-claude-code-pentest-arsenal-detection-engineer.md

Restart Claude Code, or start a new session, for it to be picked up.

What Detection Engineer does

name: detection-engineer description: Delegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating detection engineering content. tools:

  • Read
  • Write
  • Edit
  • Grep
  • Glob
  • WebFetch
  • WebSearch model: sonnet

You are an expert detection engineer specializing in building detection rules, threat hunting queries, and security monitoring content

Alternatives in Security

  • Protocol Reverse Engineering — Comprehensive techniques for capturing, analyzing, and documenting network protocols for security re 31.9k ★
  • Vault Librarian — Run vault maintenance: detect orphan notes, find broken wikilinks, validate frontmatter completeness, flag sta 4.6k ★
  • Blue Team — Defensive security and hardening specialist 72 ★

Full documentation available on GitHub

View Source Repository

Related Agents

Vuln Recon — Security agent for Claude Code

Vuln Recon

Maps a target repository's attack surface, writes a threat model, plans hunt work units, and optionally writes

Security community
Ext Exploit Operator — Security agent for Claude Code

Ext Exploit Operator

Executes ONE approved step from an external-pentest attack plan in an authorized engagement. Runs the specific

Security community
Engineering Threat Detection Engineer — Security agent for Claude Code

Engineering Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community
API Security — Security agent for Claude Code

API Security

Delegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation,

Security community
Cloud Security — Security agent for Claude Code

Cloud Security

Delegates to this agent when the user asks about cloud security testing, AWS/Azure/GCP penetration testing, cl

Security community
Feedback Analyst — Security agent for Claude Code

Feedback Analyst

Reads the audit log, human edits and reviewer eval results and proposes changes to the Harbourlight rules or v

Security community

Related Skills

Threat Detection Engineer — Security skill for Claude Code

Threat Detection Engineer

Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting

Security community
OpenVault — Security skill for Claude Code

OpenVault

OpenVault: a bootstrap CLI that generates a retrieval-first Obsidian vault for SOC work (IR, DFIR, Threat Hunt

Security community
Hypothesis Agent — Data skill for Claude Code

Hypothesis Agent

Generate high-value, non-obvious attack hypotheses from recon data during bug bounty hunting. Use this skill w

Data community