> For the complete documentation index, see [llms.txt](https://docs.scanner.dev/scanner/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/agent-skills.md). # Agent Skills Install ready-made Claude Code skills for SOC operations and detection engineering from the scanner-inc/agents repository. Agent Skills are packaged, repeatable workflows for AI coding agents. Each skill bundles an investigation or engineering methodology, reference material, and helper scripts behind a single command. Instead of prompting from scratch, an analyst types `/triage-alert ` and gets a complete, structured triage investigation: hypothesis generation, evidence collection, classification with confidence, and a report. The skills live in the [`scanner-inc/agents`](https://github.com/scanner-inc/agents/tree/main/skills) public repository, packaged as a Claude Code plugin named `scanner-soc-skills`. Each skill follows the open [Agent Skills](https://agentskills.io) format (a folder with a `SKILL.md` entry point), so while they are built and distributed as Claude Code skills, they also work in other agents that support the format, such as Cursor and OpenAI Codex CLI. They are built on Scanner MCP and encode the same workflows described in [Interactive Investigations](/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/interactive-investigations.md) and [Detection Engineering](/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/detection-engineering.md), so they are a fast way to put those methodologies to work without writing your own prompts. ## How teams use these skills The skills are general-purpose, but a few workflows stand out as the highest-leverage ways teams apply them. A coding agent working through Scanner MCP can run dozens of queries, test hypotheses, and assemble a report in the time it takes to run a single manual investigation, so for many teams these skills have become their primary way of operating Scanner day to day, replacing much of their interaction with the UI. ### Threat hunting `/threat-hunt` with no arguments pulls in recent threat intelligence on its own: it selects the most environmentally relevant CVE from CISA's Known Exploited Vulnerabilities catalog, sweeps your historical logs for the associated indicators of compromise, and generates a threat hunt report on your exposure. You can also point it at whatever you want hunted: a specific CVE, a malware family or threat actor, an IOC, a URL to a breach report or threat intel writeup, or just an idea you want chased down. Hunts that would take an analyst a day of manual query writing run unattended in minutes. ### Alert triage `/triage-alert` takes an alert id copied out of Scanner, or a natural language instruction about the kinds of alerts you want dug into (you can even ask it to use its own judgment about which alerts deserve attention). It then runs a deep dive investigation following a structured [triage methodology](https://github.com/scanner-inc/agents/blob/main/skills/triage-alert/references/methodology.md): it generates ranked hypotheses (benign activity, misconfiguration, actual attack), collects evidence from the logs surrounding the alert to confirm or refute each one, and runs a self-critique pass to catch missed evidence and alternative explanations before concluding. The report gives you a timestamped timeline of the suspicious activity, an assessment of whether it is benign, suspicious, or malicious with confidence and reasoning, and the full hypothesis testing matrix showing what it tried, what it ruled out, and how it reached its conclusion. ### Accelerating detection engineering The detection engineering skills cover the full lifecycle of a rule, and fast historical backtesting is what makes each step quick: because Scanner queries over months of logs complete in seconds, the agent can test every candidate rule against your real data instead of deploying it and waiting to see what happens. Tuning is where this matters most. `/tune-detection` investigates a noisy rule against your recent detection data, classifies its firings as false positives or true positives, and proposes a tuning patch appropriate to your environment: extra filter clauses, thresholds, dedup windows, or severity changes. It seeds regression tests from the false positive events and backtests the tuned rule, so you can see exactly how many alerts the rule will generate before you push it. Rules that would take weeks of deploy-observe-adjust cycles get tuned in a single sitting. The same loop applies to creating rules. `/write-detection` authors a brand new rule from a natural language description of the behavior you want to catch, samples real production data to sanity-check the filter, seeds inline unit tests from real events, and backtests the query across your history to predict its firing rate. `/write-correlation` builds on your existing rules, creating a rule that fires when several others co-fire on the same user, IP, or host within a time window. For teams coming from another platform, `/migrate-detection` translates rules from Splunk, Sigma, Chronicle YARA-L, Panther, Azure Sentinel, or Elastic into Scanner detection-rule YAML, testing each translated query against your real logs rather than translating blind. Some customers have migrated hundreds of detection rules in a handful of days this way. ### Assessing MITRE ATT\&CK coverage quickly `/posture-report` and `/recommend-detections` together give you a fast read on where your detection coverage stands. The posture report summarizes your environment, alert activity, and coverage gaps; the recommendations skill turns that into a prioritized punch-list of rules to write, rules to tune, and out-of-the-box packs to enable, each ending with the exact skill invocation to act on it. What would otherwise be a manual coverage audit becomes something you can rerun any time in minutes. ### Normalizing logs to a common schema Scanner's built-in transformations normalize supported log sources to ECS (Elastic Common Schema), but many teams have a preferred common schema of their own. `/write-vrl` authors a VRL transformation targeting whatever schema you choose, runs it against your sample logs with `vector vrl`, and iterates until the output matches. This makes it fast to bring custom or unusual log sources into a consistent shape, and just as fast to refine the transformation as the source evolves. See [Data Transformations](/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/data-transformations.md) for how transformations fit into ingestion. ## What's included ### SOC operations | Skill | What it does | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/triage-alert ` | Looks up a Scanner detection alert and runs a full triage investigation: hypothesis generation, evidence collection from surrounding logs, classification (benign / suspicious / malicious) with confidence, and a structured report. | | `/threat-hunt [topic]` | Runs a proactive hunt across historical logs using fresh threat intelligence. With no argument, it picks the most environmentally relevant CVE from CISA KEV; with an argument, it hunts that CVE, malware family, threat actor, or IOC. | | `/posture-report` | Produces a daily posture report: environment overview, log volume, alert activity, coverage gaps, and recommended next moves. | | `/investigate ` | Answers a free-form security question against your Scanner tenant using a summarize, plan, execute workflow, and returns a structured finding. | | `/lookup-ioc ` | Looks up an IP, domain, URL, file hash, or CVE across abuse.ch ThreatFox, AlienVault OTX, and (for IPv4) Feodo Tracker, and returns a merged threat-intel report. | ### Detection engineering | Skill | What it does | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `/write-detection` | Authors a new detection rule from a natural-language description, samples real data to sanity-check the filter, seeds inline unit tests from real events, validates with `scanner-cli`, and backtests against historical logs. | | `/tune-detection ` | Investigates a noisy rule against real detection data, classifies recent firings as false positive or true positive, and produces a tuning patch with regression tests. | | `/migrate-detection` | Translates a single rule from Splunk, Sigma, Chronicle YARA-L, Panther, Azure Sentinel, or Elastic into Scanner detection-rule YAML, testing the translated query against your real logs. | | `/write-correlation` | Authors a correlation rule that fires when multiple other rules co-fire on the same entity (user, IP, host) within a time window. | | `/recommend-detections` | Produces a prioritized list of detection-engineering recommendations: new rules to write, rules to tune, correlations to add, and out-of-the-box rule packs worth enabling. | ### Ingest engineering | Skill | What it does | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/write-vrl` | Authors and tests a VRL (Vector Remap Language) program for a Scanner transformation step, iterating against your sample logs with `vector vrl` until the output matches the objective. | ### Reporting | Skill | What it does | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | `/report-as-html` | Renders a finished report from another skill (for example `/posture-report` or `/triage-alert`) as a polished, self-contained HTML file. | ## Prerequisites * An agent that supports the Agent Skills format: **Claude Code** (with plugin marketplace support), **Cursor**, **OpenAI Codex CLI**, and others * **Scanner MCP** configured in that tool (see [Getting Started](/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/getting-started.md)) * **`scanner-cli`** on your PATH, for the detection engineering skills * **`vector`** binary on your PATH, for `/write-vrl` only The skills read the following environment variables: | Variable | Required | Purpose | | ------------------------ | ------------------------- | ---------------------------------------------------------------- | | `SCANNER_API_URL` | Yes | Your team's API endpoint, with no trailing slash | | `SCANNER_API_KEY` | Yes | A Scanner API key (created at **Settings > API Keys**) | | `SCANNER_TEAM_ID` | Yes | Your team identifier | | `SCANNER_DETECTIONS_DIR` | For detection engineering | Comma-separated paths to your local detection rules repositories | | `OTX_API_KEY` | Optional | AlienVault OTX enrichment for IOC lookups | | `ABUSECH_AUTH_KEY` | Optional | abuse.ch ThreatFox and Feodo Tracker enrichment for IOC lookups | ## Installation Clone the repository: ```bash git clone https://github.com/scanner-inc/agents.git cd agents ``` ### Claude Code Inside Claude Code, add the marketplace and install the plugin: ``` /plugin marketplace add ./skills /plugin install scanner-soc-skills@scanner-soc-skills ``` The skills load automatically; run `/reload-plugins` if they don't appear. Verify the installation by running a skill, for example `/triage-alert ` with a recent alert id from your tenant. ### Cursor, Codex CLI, and other tools The plugin marketplace is Claude Code specific, but the skills themselves are standard `SKILL.md` folders. To use them in another agent that supports the Agent Skills format, copy the skill folders you want (along with the `shared/` folder they reference) into that tool's skills directory: * **Cursor:** `.cursor/skills/` in your project, or `~/.cursor/skills/` for all projects * **OpenAI Codex CLI:** `~/.codex/skills/`, or `.agents/skills/` in your repository Configure Scanner MCP and the environment variables above in that tool, then invoke the skills the same way (Cursor exposes them in its slash command menu; Codex matches them by description or explicit mention). ## Updating Pull the repository: ```bash git -C path/to/agents pull ``` Then, inside Claude Code, refresh the marketplace: ``` /plugin marketplace update scanner-soc-skills /reload-plugins ``` If you copied the skills into another tool's skills directory, re-copy the updated folders after pulling. ## Skills vs. deployed agents Skills run interactively in your coding agent on an analyst's machine: you invoke them, watch them work, and steer them. Several have deployed counterparts in the same repository that run on a schedule or respond to webhooks, such as alert triage, threat hunting, and daily posture reporting. When you want a workflow running continuously without an analyst in the loop, see [Deploying Agents](/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/agent-skills.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.