karunanithiharikishore-hub

Bastion AI — Security skill for Claude Code

Security community

Your AI fortress of security analysts — a local, read-only SOC log-analysis tool that turns Claude Code into a team of grounded AI security agents (ATT&CK, correlation, IOCs, RCA storyline, live agent.

How to install Bastion AI

This entry records only its repository, not the path inside it, so there is no exact command to give. Open karunanithiharikishore-hub/bastion-ai and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Bastion AI does

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Portaljs Check Data Quality — Audit a local or remote tabular file (CSV/TSV) for common data quality issues 2.3k ★
Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★

README

Bastion AI

**Your AI fortress of security analysts.**

Drop in your security logs. A team of AI SOC agents investigates them and hands back a verdict, the attack storyline, IOCs and an IR report — every claim checked against your actual log lines.

![Python](https://img.shields.io/badge/python-3.10%2B-blue) ![License: MIT](https://img.shields.io/badge/license-MIT-green) ![Runs locally](https://img.shields.io/badge/runs-locally%2C%20read--only-informational) ![Powered by Claude](https://img.shields.io/badge/powered%20by-Claude%20Code-8A63D2)

![Agent SOC floor](docs/screenshots/05-swarm.png)

Why

Startups and small teams collect plenty of logs but have no blue team to read them. The evidence of one attack is split across Entra, EDR, DNS and the firewall, and nobody has time to stitch it together. Bastion AI does that stitching and puts a team of AI analysts on it, using the Claude Code you already run on your Mac.

Highlights

No API key on a Mac with Claude Code — every agent runs as its own claude -p session on your existing login.
Local and read-only — logs stay on your machine; Bastion never touches your environment.
Many sources, one storyline — events from every source go on one timeline, mapped to MITRE ATT&CK and correlated into scored incidents.
A real SOC team — Incident Commander, one Tier-1 analyst per log source, a Tier-2 verifier, and 7 specialists (IR, forensics, threat hunting, malware, threat intel, security architecture, vulnerabilities).
Grounded, not hallucinated — findings must cite real event IDs; any IP, domain or hash not in your logs is rejected.
Prompt-injection aware — logs are treated as hostile data; planted instructions are flagged, never obeyed.
Two speeds — Quick analysis (~1 min) or Deep investigation with the full agent swarm.
Live dashboard — drag and drop logs and watch the agents deploy, call tools and file findings in real time.