Bhusa Anthropic CyberSecurity Skills — DevOps skill for Claude Code

Resources

`RESOURCES.md` — repo, frameworks, per-technique ATT&CK links, agent tooling, AWS hardening, and DFIR references.

Fielding questions at the booth

`BOOTH-QA.md` (presenter-only) has tight, honest answers for the off-scenario questions that actually bite: affiliation, mapping validation, "is this just your company", safety, and "does it do ". Read it before the floor opens.

Running it on the floor (read ops/ first)

1. Decide the posture — ops/POSTURE.txt. Instructor-live+participant-static (simple, recommended) vs participant-live via gateway (richer, more to stand up). Pick before the show.
2. Day-before — ops/preflight.sh tells you which model path this network allows (cloud / local / static) and checks for stray commercial branding. There is no local-model path: this kit is API-only by design (see ops/POSTURE.txt).
3. Key safety — the real Anthropic key lives ONLY on the gateway laptop (ops/gateway-up.sh + ops/gateway-litellm.yaml). Participant laptops use ops/station.sh — a gateway token, never the key.
4. Model is pinned to a non-Fable-5 model to avoid the safeguard model-swap seen last run.
5. Block-never-dies — if cloud AND local are down, backstop/flagship-lsass.txt is the canned analysis.
6. CLAUDE.md auto-loads a defensive-analyst framing (cuts refusals + skill-misrouting).
7. Send ops/arsenal-ops-email.txt — it unblocks all of the above (network + day-before slot).

Playable data the agent runs skills on

`datasets/` holds six synthetic, analysis-only artifacts across domains — credential-dumping (Sysmon), Kerberos 4769, NetFlow, domain-fronting proxy logs, a sandbox report, and OSINT indicators — each mapped to a real loaded skill and threaded to the same attacker as the main scenarios. Prompts + answer key: SECURITY-OPS-COVERAGE.md.

Any security operation? Start here

`SECURITY-OPS-COVERAGE.md` routes any visitor — DFIR, hunting, detection, web, cloud, GRC, CVE triage — to