Specter — Security skill for Claude Code
Real-time SIEM security dashboard with AI-powered alert analysis.
How to install Specter
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open CarbeneAI/Specter and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Specter does
Real-time SIEM security dashboard with AI-powered alert analysis. Connects to Wazuh & Suricata.
Alternatives in Security
- Google Workspace Alert Center — Manage security alerts 21.6k ★
- Security Guardian — Comprehensive security analysis for RTK CLI tool, focusing on command injection, shell escaping, hook security 11.9k ★
- Deepsec — Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents 7.8k ★
README
Specter
**Real-Time SIEM Dashboard with AI-Powered Alert Analysis**
[](LICENSE) [](https://bun.sh) [](https://vuejs.org)
Specter is a real-time security dashboard that connects to your Wazuh SIEM and Suricata IDS. It streams live alerts with severity-based color coding and includes an AI chat panel (Claude) that can autonomously search your historical alerts to provide context-aware threat analysis.
About CarbeneAI
Specter is one of four open-source security tools published by CarbeneAI, alongside [Harbinger](https://github.com/CarbeneAI/Harbinger) (AI threat intel), [Talon](https://github.com/CarbeneAI/Talon) (AI-assisted offensive workflows), and [Forge](https://github.com/CarbeneAI/Forge) (AI operations platform).
CarbeneAI builds open-source tooling for security operations and teaches practitioners to build their own. These repos are the working reference.
Use this repo. Fork it. Improve it. More at [carbene.ai](https://carbene.ai)
Features
- Deterministic Scorer - Rules-only pre-triage that scores every alert 0-100 and bands it critical/high/medium/low/noise before any LLM is called. No API key, no network call, so it keeps working when the AI chat is unconfigured. Every weight lives in one documented constant.
- Investigation Ledger - Every AI investigation persisted as a replayable record: system prompt, each tool call and its result, final analysis, token counts, timing. Addressable by permalink. The receipt that makes autonomous response auditable after the fact.
- Live Alert Streaming - WebSocket-based real-time alert feed from Wazuh Indexer (polls every 30s)
- Severity Color Coding - CarbeneAI dark theme with Critical/High/Medium/Low visual hierarchy
Related Skills
Claude Mission Control
Real-time command center for Claude Code agents. Monitor all agents from one dashboard, send instructions, tra
Mcp-scan (Invariant Labs)
MCP security scanner with proxy mode for real-time scanning without infrastructure changes.
Vcp
Vibe Coding Protocal - Security-first protocol for AI-generated code, multiple standards with real-time enforc
Sandspy
Real-time security monitor for AI coding agents. See what Claude Code, Cursor, Codex, and others actually do o
Latency Arbitrage
Detect and exploit price latency gaps between real-time crypto prices and Polymarket prediction market prices.
Claude Code Marketing Skills
git clone https://github.com/cognyai/claude-code-marketing-skills ~/.claude/skills/claude-code-marketing-skill
Related Agents
Infra Threat Detection
Active alert triage and telemetry correlation. Reads SIEM alerts and the central journal, correlates across do
Engineering Threat Detection Engineer
Expert detection engineer specializing in SIEM rule development, MITRE ATT&CK coverage mapping, threat hunting
Taskade
AI-powered workspace with autonomous agents, real-time collaboration, and workflow automation with MCP integra
