/ir
Incident response workflow — triage, evidence collection, timeline, and IOC extraction
$ npx -y skills add mukul975/Threatswarm --agent claude-codeShips with threatswarm. Installing the plugin gets this command.
How it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/ir
Context preview
What this command does when you run it.
Incident response workflow — triage, evidence collection, timeline, and IOC extraction
27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.
Other commands on threatswarm.
- /attack
Route an attack vector to the appropriate specialist agent — usage: /project:attack <target> <vector>
Open command - /engage
Start a new engagement for a target — verifies scope, creates evidence directories, and launches recon agent
Open command - /hunt
Run an ATT&CK-based threat hunt with a specific hypothesis
Open command - /pwned
Post-exploitation workflow after getting shell access — privesc, credential harvest, lateral movement
Open command - /report
Generate a professional penetration test report from all evidence files
Open command