Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+17 more

    Cyber Attack Chain Analysis

    2

    Transform incident timelines into structured Cyber Kill Chain mappings and high-impact defensive roadmaps.

    $12

    30-day refund guarantee

    Secure checkout via Stripe

    0 installsSecurity scanned

    See it in action

    You say

    Analyse this incident timeline against the Cyber Kill Chain and produce a phase-by-phase detection gap report for security leadership. The incident involved spearphishing delivery, a malicious macro, PowerShell execution, lateral movement via remote management tools, and data staging before exfiltration was detected. I have the alert log and the case notes from the investigation.

    Your agent does

    The skill produces a structured report mapping each observed event to a Cyber Kill Chain phase with detection status (detected, missed, blocked, or unknown) and first detection point. It includes a phase-by-phase defensive gap assessment, a MITRE ATT&CK technique linkage table where evidence supports it, and a prioritised control improvement roadmap. An executive summary and a chronological event timeline are included, along with evidence gaps and validation questions for unresolved phases.

    What you get

    Map fragmented incident logs to formal attack phases with evidence markers.Identify the specific phase where an intrusion could have been first detected.Generate a prioritized control improvement roadmap for security leadership.Correlate observed adversarial movement with MITRE ATT&CK techniques.

    About this skill

    Stop Guessing, Start Mapping

    Modern incident response requires more than just a list of alerts; it demands a structured understanding of how an adversary progressed through your environment. This skill provides a rigorous, evidence-based analysis of intrusion activity using the Cyber Kill Chain framework. It transforms fragmented logs and timeline notes into a strategic defensive roadmap.

    Advanced Analytical Depth

    Unlike basic prompting, this skill enforces strict evidentiary standards. It distinguishes between confirmed facts and assumptions, identifies the 'first point of detection,' and highlights exactly where your visibility failed. It doesn't just list what happened; it analyzes why it wasn't stopped sooner.

    Framework & Tool Agnostic

    • Frameworks: Primary mapping to Cyber Kill Chain with secondary support for MITRE ATT&CK® tactics and techniques.
    • Enterprise Integration: Adaptable to any security stack (SIEM, EDR, XDR) provided by the user.
    • Strategic Output: Generates executive summaries, detection gap registers, and prioritized remediation roadmaps.

    Why This Skill?

    Security analysts often struggle to translate technical findings into leadership-ready reports. This skill automates the heavy lifting of phase categorization and gap analysis while maintaining high-fidelity security standards, ensuring your post-incident reviews are objective, exhaustive, and actionable.

    How to install

    Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 3 months ago

    • One-time purchase, yours forever

    Listed3 months ago

    Frequently Asked Questions