Awesome Dfir Skills

🔥 awesome-dfir-skills

[](https://awesome.re) [](http://makeapullrequest.com) [](#)

A community-driven collection of DFIR / incident response **skills**: reusable prompts, workflows, and helper files that help practitioners move faster, stay consistent, and maybe—just maybe—get some sleep.

---

🚀 Quick Start

undefined

**Pro tip:** Keep placeholders like `{{time_window}}` as-is—fill them in when the skill asks for them.

---

🤔 What's a "Skill" Anyway?

Think of a skill as a **cheat code for IR**. It's a small, reusable artifact you can copy/paste into your AI assistant or playbook to get consistent, high-quality outputs every time.

Each skill is designed to:

Feature	Why It Matters
📥 Clear inputs & outputs	No guessing games
🎯 Explicit about unknowns	Fewer hallucinations, more facts
🔒 Safe-by-default	Evidence handling & privacy baked in

---

📁 Repository Layout

skills/
├── README.md                          # Start here → skill catalog
├── _templates/
│   └── skill.md                       # Template for new skills
└── /
    └── /
        ├── skill.md                   # The skill entrypoint
        └── helpers/                   # Query snippets, regex, parsers

---

🛠️ Platform Setup

Claude Desktop / Claude.ai

Skills are folders of instructions that Claude loads dynamically:

undefined

OpenAI / Codex

Codex loads skills from a dedicated folder (e.g., `$REPO_ROOT/.codex/skills`):

undefined

...