Cyber Defense Crown Pack
Ten evidence-bound defensive skills for incident command, threat hunting, and security architecture reviews.
$50
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsCyber Defense Crown Pack
Example session with this skill installed
Run a cloud identity review for a suspected M365 compromise. I have the sign-in logs and a list of recently added OAuth apps. Focus on finding persistence and scoping the blast radius.
- Read your context and instructions
- Compiled the cyber defense crown
- Generated the document
Illustrative example. Case IDs, accounts, and log entries are invented.
I have initiated the Cloud Identity Incident Commander workflow. The analysis is currently in the 'Find Persistence' phase based on the provided M365 logs.
Cloud Identity Incident Report: Case 2024-08-12-M365
| Category | Finding ID | Description | Evidence Source | Confidence |
|---|---|---|---|---|
| Persistence | P-001 | New OAuth App 'GraphExplorer_Temp' granted Mail.ReadWrite | AuditLog_20240812_1400 | High |
| Persistence | P-002 | MFA Method added (SMS) for user 'admin_backup' from IP 192.0.2.45 | SigninLog_20240812 | Medium |
| Blast Radius | B-001 | Unauthorized access to 'Quarterly_Financials.xlsx' via service principal | UnifiedAuditLog | High |
| Trust Path | T-001 | Federation settings modified; new domain 'contoso-security.com' added | TenantConfig_Export | High |
Proposed Containment Sequence
Revoke Sessions: Terminate all active sessions for admin_backup and the service principal associated with GraphExplorer_Temp.
2. App Removal: Delete OAuth application ID de30-4567-ac89 and verify no other apps share the same redirect URI.
3.
Rollback Federation: Remove the unauthorized federated domain and reset the global admin password via an out-of-band break-glass account.
Next steps
- Verify if any mail forwarding rules were created for the compromised accounts.
- Perform a delta sync check between the current tenant state and the last known good backup.
- Execute the
dfir-evidence-casebuilderto formalize the timeline for legal review.
Quarterly_Financials.xlsx
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
About this skill
Responding to a security incident without a structured playbook leads to evidence destruction, incomplete containment, and repeat compromises. The Cyber Defense Crown Pack provides ten specialized, evidence-bound skills for incident response, threat hunting, and defensive reviews. It enforces a strict eight-phase workflow for every task, ensuring that hypotheses, facts, and actions remain distinct.
What it does
- Incident Command provides structured playbooks for ransomware, cloud identity (M365/Google), phishing, and software supply chain compromises.
- Evidence Management builds reproducible DFIR cases with custody tracking, normalized timelines, and explicit uncertainty markers.
- Detection Engineering creates Sigma-compatible behavior-based rules complete with telemetry contracts and noise budgets.
- Defensive Reviews audits Kubernetes manifests, RBAC authority, and agentic AI systems for prompt injection or authority confusion.
- Remediation Planning transforms CISA KEV data and asset inventories into prioritized, verification-ready patching waves.
How it works
- Intake Gate establishes the authorized scope, assets, and permitted actions before any analysis begins.
- Select Skill routes the task to the specific folder (e.g.,
dfir-evidence-casebuilder) matching the security domain. - Execute Workflow follows the eight-phase playbook to map systems, build authority graphs, and classify attack surfaces.
- Validate & Report checks each case file against its JSON Schema with a local deterministic validator.
Frameworks & tools
Methods reference public frameworks: MITRE ATT&CK, Sigma-compatible rule output, CISA KEV, CISA SCuBA baselines, and SSVC-inspired decision trees. Sources are cited, not bundled, and no endorsement is claimed. It supports Kubernetes manifests, cloud tenant audit logs, and M365/Google Workspace identity telemetry.
Why this beats prompting it yourself
Generic prompts often ignore evidence volatility and rush to remediation, which can tip off adversaries or destroy forensic data. This pack enforces read-only analysis by default and validates every case file against a schema with a local deterministic validator.
Use cases
- Coordinating a ransomware response from first signal through clean restoration.
- Investigating M365 account takeovers and planning scoped revocation of persistent OAuth grants.
- Engineering behavior-based detection rules with positive and negative fixtures.
- Threat modeling a new LLM agent implementation for tool-use risks.
Known limitations
Analysis is read-only by default and does not perform autonomous patching or negotiation. It requires manual provision of authorized logs and asset inventories.
What's included (11 skills)
cyber-defense-crown-pack
Ten defensive security skills: ransomware, cloud identity, phishing/BEC, and supply-chain incident command; DFIR casebuilding; detection rule engineering; threat hunting; KEV remediation; Kubernetes review; and agentic system defense review. Read-only by default, evidence-bound, each with a schema, local validator, and fixtures. Pick the included skill that matches the task.
cyber-defense-agentic-system-review
Threat-model and validate tool-using AI systems against prompt injection, data poisoning, authority confusion, secret exposure, unsafe actions, and weak recovery. Use for defensive architecture and controlled testing only.
cyber-defense-cloud-identity-commander
Investigate and contain Microsoft 365 or Google Workspace identity compromise using tenant evidence and dependency-aware session controls. Use for authorized cloud incidents and baseline review.
cyber-defense-detection-rule-engineer
Create and validate portable behavior-based detection rules with telemetry contracts, positive and negative fixtures, false-positive budgets, and staged rollout. Supports Sigma-compatible output without bundling SigmaHQ rules.
cyber-defense-dfir-casebuilder
Turn authorized host, network, cloud, identity, and application evidence into a reproducible incident case with custody, timelines, hypotheses, and explicit uncertainty. Not a law-enforcement or legal-opinion tool.
cyber-defense-threat-hunt-engineer
Design and run authorized behavior-based threat hunts with ATT&CK-grounded hypotheses, telemetry feasibility, negative results, and promotion-ready detections. Do not probe adversary infrastructure.
cyber-defense-kev-remediation-commander
Turn asset inventory and CISA KEV evidence into defensible, verification-ready remediation waves. Use for vulnerability operations planning; do not use to scan or patch systems without authorization.
cyber-defense-kubernetes-review
Review Kubernetes architecture and manifests across supply chain, control plane, RBAC, workload, network, secrets, admission, and runtime evidence. Use on authorized clusters or configuration; default to read-only review.
cyber-defense-phishing-bec-commander
Triage phishing and business-email-compromise incidents from preserved message and identity evidence through financial, tenant, and recipient containment. Never open suspect content outside isolation or initiate financial transactions.
cyber-defense-ransomware-incident-commander
Coordinate evidence-preserving ransomware and data-extortion response from first signal through clean recovery. Use for tabletop planning or authorized live incidents; never autonomously negotiate, pay, or destroy evidence.
cyber-defense-supply-chain-tracer
Trace suspected software supply-chain compromise from source and suppliers through builders, artifacts, registries, deployments, and customers. Use for authorized investigation and due diligence.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean today
- Passed all security checks, Safe to install