Skill
attack-mapping
Check or add ATT&CK technique ids on a finding by grounding each id in an observable. Read this when a triage, investigation, or…
@vigil-socInstall SkillSecurity
Skill
/network-shape
Traffic shape -- beaconing intervals, jitter, volume asymmetry, DNS and HTTP. Load when a hypothesis is about how hosts talk.
Install
$ npx -y skills add Vigil-SOC/vigil --skill network-shape --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/network-shape
Context preview
The summary Claude sees to decide when to auto-load this skill.
Traffic shape -- beaconing intervals, jitter, volume asymmetry, DNS and HTTP. Load when a hypothesis is about how hosts talk.
SKILL.md
network-shape.SKILL.mdname: network-shape description: Traffic shape -- beaconing intervals, jitter, volume asymmetry, DNS and HTTP. Load when a hypothesis is about how hosts talk.
Network shape
Query the network telemetry -- flows, HTTP and DNS -- in the query language of whichever system this deployment runs. Findings carry what detection already scored; the shape of traffic is not in them, so the telemetry is where these answers are.
If this deployment exposes no telemetry search, say so as a gap in what could be seen. Do not infer traffic shape from alert records.
You are looking at the shape of traffic, not its content. Characterise periodicity and its jitter, bytes out against bytes in, connection counts per destination, and the lifetime of a pair. A regular interval with low variance is the signal; a busy host is not.
Quantify. "Every 300s +/- 4s over 6 hours, 412 connections" is a finding; "frequent connections" is not.
Ships withvigil
Vigil is an open source, agentic AI SOC released under Apache 2.0. Your playbooks are plain-text Markdown files, your agent logic is readable code, and your integrations use an open standard (MCP). It is a capability you own, not a black box you rent.
Get the whole plugin
Stats
407
Stars
93
Forks
Active
Maintenance
Python
Language
Apache-2.0
License
2h ago
Last commit
7mo ago
Created
6h ago
Added
Other skills on vigil.
@vigil-socInstall SkillSkill
beaconing-review
Grade a periodic outbound flow as c2, suspicious, or benign-periodic. Read this when raw_data shows a repeating connection and…
@vigil-socInstall SkillSkill
executive-summary
Write a security report for a chosen audience - technical report, executive summary, or one-page board brief with…
@vigil-socInstall SkillSkill
findings-and-telemetry
Broad behavioural hunting across the findings detection already scored and the raw telemetry behind them.
@vigil-socInstall SkillSkill
hunt-method
How to move a hunt from its hypotheses to verdicts -- what to query next, when to validate, when to stop. Load at the start of a…
@vigil-socInstall SkillSkill
investigate-case
Method for working one open case from its findings to a supported disposition. Load at the start of a case.
@vigil-socInstall Skill