/crowdsentinel-skills

name: crowdsentinel-skills
description: Comprehensive threat hunting and incident response skill for CrowdSentinel MCP Server. Provides decision frameworks (MITRE ATT&CK, NIST IR, Pyramid of Pain, Diamond Model), workflow guidance, executable scripts for Elasticsearch queries, field mapping assistance, and debugging tools.

CrowdSentinel Skills - Threat Hunting & Incident Response

When to Use This Skill

Use this skill when:

• Conducting threat hunting on Elasticsearch/OpenSearch logs
• Running detection rules (EQL, ES|QL, Lucene)
• Investigating security incidents
• Analysing Windows/Linux logs for threats
• Debugging Elasticsearch connection issues
• Handling field mapping mismatches (non-ECS data)
• Presenting investigation findings to users

---

The Iron Law

┌─────────────────────────────────────────────────────────────────────┐
│   NO INVESTIGATION IS COMPLETE WITHOUT ANALYSIS TOOLS               │
│                                                                     │
│   If you have collected data but haven't used analysis tools,       │
│   the investigation is INCOMPLETE.                                  │
└─────────────────────────────────────────────────────────────────────┘

---

Decision Tree: What Should I Do?

START: User Request
    │
    ├─→ "Hunt for threats" / "Find suspicious activity"
    │       └─→ Go to: THREAT HUNTING WORKFLOW
    │
    ├─→ "Run detection rule" / "Execute rule"
    │       └─→ Go to: DETECTION RULE WORKFLOW
    │
    ├─→ "Investigate incident" / "Analyse this host"
    │       └─→ Go to: INCIDENT RESPONSE WORKFLOW
    │
    ├─→ "Connection error" / "Query failed"
    │       └─→ Go to: DEBUGGING WORKFLOW
    │
    ├─→ "Field not found" / "Query returns empty"
    │       └─→ Go to: FIELD MAPPING WORKFLOW
    │
    └─→ "Analyse PCAP" / "Network traffic"
            └─→ Go to: WIRESHARK WORKFLOW (see wireshark-mcp-ir-th skill)

---

THREAT HUNTING WORKFLOW

Phase 1: Data Collection

| Tool | When to Use | Token Efficiency | |------|-------------|------------------| | `threat_hunt_search` | IR-focused search with auto IoC extraction | High (PREFERRED) | | `smart_search` | Quick counts and summarisation | Very High | | `execute_detection_rule` | Run curated EQL/Lucene rules | Medium | | `execute_esql_hunt` | Run curated ES|QL hunting queries | Medium | | `esql_query` | Ad-hoc ES|QL queries | Low | | `eql_search` | Ad-hoc EQL queries | Low | | `search_with_lucene` | Flexible Lucene queries | Low |

**Decision: Which search tool?**

Is this an initial triage?
    │
    ├─→ YES: Use smart_search or quick_count first
    │         └─→ Then threat_hunt_search for details
    │
    └─→ NO: Do you need specific detection logic?
            │
            ├─→ YES: Use execute_detection_rule or execute_esql_hunt
            │
            └─→ NO: Use threat_hunt_search (auto IoC extraction)

Phase 2: Analysis (MANDATORY - NEVER SKIP)

After EVERY search/hunt query, you MUST use analysis tools:

# Step 1: Analyse search results
analysis = analyze_search_results(
    search_results=results,
    context="Description of what you searched for"
)
# Returns: IoCs, MITRE ATT&CK mapping, severity, recommendations

# Step 2: Position in kill chain
kill_chain = analyze_kill_chain_stage(
    iocs=[{"type": "ip", "value": "..."}, {"type": "process", "value": "..."}],
    include_hunting_suggestions=True
)
# Returns: Kill chain stage, previous/next stage hunting queries

Phase 3: Investigation State (Multi-Query)

For investigations spanning multiple queries:

# Start tracking
create_investigation(
    name="Suspicious PowerShell Activity",
    description="Investigating encoded commands on DESKTOP-001",
    severity="high"
)

# Store discovered IoCs
add_iocs_to_investigation(iocs=[...])

# Retrieve for cross-correlation
shared_iocs = get_shared_iocs(ioc_types=["ip", "domain"])

Phase 4: Reporting (BEFORE Concluding)

report = generate_investigation_report(
    analysis_results=[analysis1, analysis2, ...],
    investigation_context="Summary of investigation"
)
# Returns: Executive summary, all IoCs, affected hosts, recommendations

---

DETECTION RULE WORKFLOW

Decision: Which rule type?

What log source are you hunting in?
    │
    ├─→ Windows Event Logs (winlogbeat-*, logs-windows.*)
    │       │
    │       └─→ What behaviour are you detecting?
    │               │
    │               ├─→ Sequences/Correlations → Use EQL rules
    │               │       execute_detection_rule(rule_id="..._eql", index="winlogbeat-*")
    │               │
    │               └─→ Single events → Use Lucene rules
    │                       execute_detection_rule(rule_id="..._lucene", index="winlogbeat-*")
    │
    ├─→ Linux Audit Logs (auditbeat-*, logs-linux.*)
    │       └─→ Use ES|QL hunts or Lucene rules
    │               execute_esql_hunt(rule_id="...", index="auditbeat-*")
    │
    └─→ Network Logs (packetbeat-*, logs-network.*)
            └─→ Use Lucene rules or smart_search

Finding Rules

# List rules by platform and tactic
rules = list_detection_rules(
    platform="windows",
    mitre_tactic="credential_access",
    limit=20
)

# Search by keyword
rules = list_detection_rules(search_term="mimikatz")

# Get rule details before execution
details = get_rule_details(rule_id="windows_powershell_...")

Executing Rules

# Execute single rule
result = execute_detection_rule(
    rule_id="windows_builtin_win_security_susp_logon_eql",
    index="winlogbeat-*",
    timeframe_minutes=60
)

# Execute multiple rules (batch hunt)
results = execute_multiple_rules(
    rule_ids=["rule1", "rule2", "rule3"],
    index="winlogbeat-*",
    timeframe_minutes=1440
)

# Hunt by category
results = hunt_with_rule_category(
    platform="windows",
    category="powershell",
    index="winlogbeat-*",
    timeframe_minutes=60
)

---

INCIDE