README.md

CyberSec-Ops Skill

A comprehensive AI skill for cybersecurity covering DevSecOps, SOC operations, and DevOps security.

What This Skill Does

This skill transforms your AI assistant into a senior cybersecurity architect with deep expertise across three domains:

Key Features

• 200+ production-ready detection rules (Sigma, Splunk SPL, KQL, EQL, YARA, OSQuery, Falco, Suricata, Wazuh)
• 6 compliance frameworks mapped (NIST CSF 2.0, CIS Controls v8, MITRE ATT&CK, SOC 2, ISO 27001:2022, PCI DSS v4.0)
• 8 incident response playbooks with communication templates and evidence preservation
• Progressive disclosure — only loads deep content when needed, keeping context efficient

Installation

Quick Install (Any Platform)

npx skills add Azarisa0678/cybersec-ops-skill

Manual Install

# Clone to your skills directory
git clone https://github.com/Azarisa0678/cybersec-ops-skill.git ~/.agents/skills/cybersec-ops

# Or for project-specific use
git clone https://github.com/Azarisa0678/cybersec-ops-skill.git ./.agents/skills/cybersec-ops

Platform-Specific

Usage

Automatic Activation

The skill triggers automatically when you ask cybersecurity questions:

"How do I secure my CI/CD pipeline against supply chain attacks?"
"Write a Sigma rule for detecting LSASS memory dumps"
"What are the CIS Controls for Kubernetes?"
"Help me respond to a ransomware incident"
"How do I harden my AWS IAM policies?"
"Map my controls to NIST CSF 2.0 and SOC 2"

Explicit Invocation

Force the skill to activate:

/skill cybersec-ops

Or mention it in your query:

Using the cybersec-ops skill, audit my Terraform configurations

Skill Structure

cybersec-ops/
├── SKILL.md                          # Core instructions & workflow
├── USAGE_GUIDE.md                    # Installation & usage guide
├── GITHUB_DESKTOP_GUIDE_DE.md        # German GitHub Desktop tutorial
├── scripts/                          # Automation scripts (ready for extensions)
├── assets/                           # Templates & resources
└── references/
    ├── devsecops.md                  # CI/CD, SAST/DAST, containers, IaC
    ├── soc-operations.md             # SIEM, detection, IR, threat hunting
    ├── devops-security.md            # Cloud, K8s, IAM, hardening
    ├── detection-rules.md            # 200+ rules across 9 formats
    ├── compliance-mappings.md        # 6 frameworks cross-referenced
    └── playbooks.md                  # 8 IR playbooks + comms templates

Progressive Disclosure

The skill uses lazy loading to keep context efficient:

Total: 160 KB — but only ~6-25 KB loaded per query.

Detection Rules Library

Supported Formats

MITRE ATT&CK Coverage

Rules mapped across all 14 tactics:

• Initial Access (T1566, T1189, T1190)
• Execution (T1059, T1053, T1204, T1218)
• Persistence (T1547, T1053, T1543)
• Privilege Escalation (T1078, T1055, T1548)
• Defense Evasion (T1562, T1070, T1055, T1218)
• Credential Access (T1003, T1558, T1552)
• Discovery (T1083, T1018, T1057)
• Lateral Movement (T1021, T1210, T1550)
• Collection (T1560, T1005, T1039)
• Command and Control (T1071, T1572, T1095)
• Exfiltration (T1041, T1048, T1567)
• Impact (T1486, T1490, T1491)

Compliance Frameworks

Cross-referenced mappings for:

Incident Response Playbooks

Plus: Communication templates (executive, customer, regulatory) and evidence preservation procedures.

Tooling Reference

Security Principles

1. Defense in Depth — Layer defenses across network, application, data, and identity
2. Shift-Left Security — Integrate security as early as possible in the SDLC
3. Assume Breach — Design for detection and response, not just prevention
4. Least Privilege — Grant minimum necessary access; use just-in-time elevation
5. Observability First — You can't secure what you can't see

Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/new-detection-rule)
3. Commit your changes (git commit -am 'feat: add new Sigma rule for X')
4. Push to the branch (git push origin feature/new-detection-rule)
5. Open a Pull Request

Contribution Ideas

• New detection rules for emerging threats
• Additional compliance framework mappings
• Cloud provider-specific hardening guides (GCP, Oracle, IBM)
• AI/ML security domain expansion
• Supply chain security (SLSA, Sigstore, SBOM)
• Translations (German, French, Japanese)

License

MIT License — see LICENSE for details.

Copyright (c) 2024 Azarisa0678

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

Support & Community

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Security: Report privately via GitHub Security Advisories

Acknowledgments

• Built following the Agent Skills open standard
• Detection rules inspired by Sigma HQ, MITRE ATT&CK, and the threat hunting community
• Compliance mappings based on official framework documentation

Disclaimer: This skill provides security guidance and detection rules for educational and defensive purposes only. Always test controls in non-production environments before deployment. The authors are not responsible for misuse or damage caused by the application of these techniques.