Agent Skills

Install ready-made Claude Code skills for SOC operations and detection engineering from the scanner-inc/agents repository.

Agent Skills are packaged, repeatable workflows for AI coding agents. Each skill bundles an investigation or engineering methodology, reference material, and helper scripts behind a single command. Instead of prompting from scratch, an analyst types /triage-alert <alert-id> and gets a complete, structured triage investigation: hypothesis generation, evidence collection, classification with confidence, and a report.

The skills live in the scanner-inc/agents public repository, packaged as a Claude Code plugin named scanner-soc-skills. Each skill follows the open Agent Skills format (a folder with a SKILL.md entry point), so while they are built and distributed as Claude Code skills, they also work in other agents that support the format, such as Cursor and OpenAI Codex CLI. They are built on Scanner MCP and encode the same workflows described in Interactive Investigations and Detection Engineering, so they are a fast way to put those methodologies to work without writing your own prompts.

How teams use these skills

The skills are general-purpose, but a few workflows stand out as the highest-leverage ways teams apply them. A coding agent working through Scanner MCP can run dozens of queries, test hypotheses, and assemble a report in the time it takes to run a single manual investigation, so for many teams these skills have become their primary way of operating Scanner day to day, replacing much of their interaction with the UI.

Threat hunting

/threat-hunt with no arguments pulls in recent threat intelligence on its own: it selects the most environmentally relevant CVE from CISA's Known Exploited Vulnerabilities catalog, sweeps your historical logs for the associated indicators of compromise, and generates a threat hunt report on your exposure. You can also point it at whatever you want hunted: a specific CVE, a malware family or threat actor, an IOC, a URL to a breach report or threat intel writeup, or just an idea you want chased down. Hunts that would take an analyst a day of manual query writing run unattended in minutes.

Alert triage

/triage-alert takes an alert id copied out of Scanner, or a natural language instruction about the kinds of alerts you want dug into (you can even ask it to use its own judgment about which alerts deserve attention). It then runs a deep dive investigation following a structured triage methodology: it generates ranked hypotheses (benign activity, misconfiguration, actual attack), collects evidence from the logs surrounding the alert to confirm or refute each one, and runs a self-critique pass to catch missed evidence and alternative explanations before concluding. The report gives you a timestamped timeline of the suspicious activity, an assessment of whether it is benign, suspicious, or malicious with confidence and reasoning, and the full hypothesis testing matrix showing what it tried, what it ruled out, and how it reached its conclusion.

Accelerating detection engineering

The detection engineering skills cover the full lifecycle of a rule, and fast historical backtesting is what makes each step quick: because Scanner queries over months of logs complete in seconds, the agent can test every candidate rule against your real data instead of deploying it and waiting to see what happens.

Tuning is where this matters most. /tune-detection investigates a noisy rule against your recent detection data, classifies its firings as false positives or true positives, and proposes a tuning patch appropriate to your environment: extra filter clauses, thresholds, dedup windows, or severity changes. It seeds regression tests from the false positive events and backtests the tuned rule, so you can see exactly how many alerts the rule will generate before you push it. Rules that would take weeks of deploy-observe-adjust cycles get tuned in a single sitting.

The same loop applies to creating rules. /write-detection authors a brand new rule from a natural language description of the behavior you want to catch, samples real production data to sanity-check the filter, seeds inline unit tests from real events, and backtests the query across your history to predict its firing rate. /write-correlation builds on your existing rules, creating a rule that fires when several others co-fire on the same user, IP, or host within a time window.

For teams coming from another platform, /migrate-detection translates rules from Splunk, Sigma, Chronicle YARA-L, Panther, Azure Sentinel, or Elastic into Scanner detection-rule YAML, testing each translated query against your real logs rather than translating blind. Some customers have migrated hundreds of detection rules in a handful of days this way.

Assessing MITRE ATT&CK coverage quickly

/posture-report and /recommend-detections together give you a fast read on where your detection coverage stands. The posture report summarizes your environment, alert activity, and coverage gaps; the recommendations skill turns that into a prioritized punch-list of rules to write, rules to tune, and out-of-the-box packs to enable, each ending with the exact skill invocation to act on it. What would otherwise be a manual coverage audit becomes something you can rerun any time in minutes.

Normalizing logs to a common schema

Scanner's built-in transformations normalize supported log sources to ECS (Elastic Common Schema), but many teams have a preferred common schema of their own. /write-vrl authors a VRL transformation targeting whatever schema you choose, runs it against your sample logs with vector vrl, and iterates until the output matches. This makes it fast to bring custom or unusual log sources into a consistent shape, and just as fast to refine the transformation as the source evolves. See Data Transformations for how transformations fit into ingestion.

What's included

SOC operations

Skill	What it does
/triage-alert <alert-id>	Looks up a Scanner detection alert and runs a full triage investigation: hypothesis generation, evidence collection from surrounding logs, classification (benign / suspicious / malicious) with confidence, and a structured report.
/threat-hunt [topic]	Runs a proactive hunt across historical logs using fresh threat intelligence. With no argument, it picks the most environmentally relevant CVE from CISA KEV; with an argument, it hunts that CVE, malware family, threat actor, or IOC.
/posture-report	Produces a daily posture report: environment overview, log volume, alert activity, coverage gaps, and recommended next moves.
/investigate <question>	Answers a free-form security question against your Scanner tenant using a summarize, plan, execute workflow, and returns a structured finding.
/lookup-ioc <indicator>	Looks up an IP, domain, URL, file hash, or CVE across abuse.ch ThreatFox, AlienVault OTX, and (for IPv4) Feodo Tracker, and returns a merged threat-intel report.

Detection engineering

Skill	What it does
/write-detection	Authors a new detection rule from a natural-language description, samples real data to sanity-check the filter, seeds inline unit tests from real events, validates with scanner-cli, and backtests against historical logs.
/tune-detection <rule>	Investigates a noisy rule against real detection data, classifies recent firings as false positive or true positive, and produces a tuning patch with regression tests.
/migrate-detection	Translates a single rule from Splunk, Sigma, Chronicle YARA-L, Panther, Azure Sentinel, or Elastic into Scanner detection-rule YAML, testing the translated query against your real logs.
/write-correlation	Authors a correlation rule that fires when multiple other rules co-fire on the same entity (user, IP, host) within a time window.
/recommend-detections	Produces a prioritized list of detection-engineering recommendations: new rules to write, rules to tune, correlations to add, and out-of-the-box rule packs worth enabling.

Ingest engineering

Skill	What it does
/write-vrl	Authors and tests a VRL (Vector Remap Language) program for a Scanner transformation step, iterating against your sample logs with vector vrl until the output matches the objective.

Reporting

Skill	What it does
/report-as-html	Renders a finished report from another skill (for example /posture-report or /triage-alert) as a polished, self-contained HTML file.

Prerequisites

• An agent that supports the Agent Skills format: Claude Code (with plugin marketplace support), Cursor, OpenAI Codex CLI, and others
• Scanner MCP configured in that tool (see Getting Started)
• scanner-cli on your PATH, for the detection engineering skills
• vector binary on your PATH, for /write-vrl only

The skills read the following environment variables:

Variable	Required	Purpose
SCANNER_API_URL	Yes	Your team's API endpoint, with no trailing slash
SCANNER_API_KEY	Yes	A Scanner API key (created at Settings > API Keys)
SCANNER_TEAM_ID	Yes	Your team identifier
SCANNER_DETECTIONS_DIR	For detection engineering	Comma-separated paths to your local detection rules repositories
OTX_API_KEY	Optional	AlienVault OTX enrichment for IOC lookups
ABUSECH_AUTH_KEY	Optional	abuse.ch ThreatFox and Feodo Tracker enrichment for IOC lookups

Installation

Clone the repository:

git clone https://github.com/scanner-inc/agents.git
cd agents

Claude Code

Inside Claude Code, add the marketplace and install the plugin:

/plugin marketplace add ./skills
/plugin install scanner-soc-skills@scanner-soc-skills

The skills load automatically; run /reload-plugins if they don't appear. Verify the installation by running a skill, for example /triage-alert <alert-id> with a recent alert id from your tenant.

Cursor, Codex CLI, and other tools

The plugin marketplace is Claude Code specific, but the skills themselves are standard SKILL.md folders. To use them in another agent that supports the Agent Skills format, copy the skill folders you want (along with the shared/ folder they reference) into that tool's skills directory:

• Cursor: .cursor/skills/ in your project, or ~/.cursor/skills/ for all projects
• OpenAI Codex CLI: ~/.codex/skills/, or .agents/skills/ in your repository

Configure Scanner MCP and the environment variables above in that tool, then invoke the skills the same way (Cursor exposes them in its slash command menu; Codex matches them by description or explicit mention).

Updating

Pull the repository:

git -C path/to/agents pull

Then, inside Claude Code, refresh the marketplace:

/plugin marketplace update scanner-soc-skills
/reload-plugins

If you copied the skills into another tool's skills directory, re-copy the updated folders after pulling.

Skills vs. deployed agents

Skills run interactively in your coding agent on an analyst's machine: you invoke them, watch them work, and steer them. Several have deployed counterparts in the same repository that run on a schedule or respond to webhooks, such as alert triage, threat hunting, and daily posture reporting. When you want a workflow running continuously without an analyst in the loop, see Deploying Agents.