Agent Skills
› zakirkun/deep-eye
› blue-team
blue-team
GitHub基于Deep Eye攻击语料进行蓝队防御，涵盖检测工程、SIEM规则编写、威胁狩猎及控制验证。通过生成测试用例、回放扫描和测量误报率，优化安全检测能力并指导加固策略。
Trigger Scenarios
需要编写或优化SIEM/WAF检测规则
进行安全控制有效性验证
执行威胁狩猎或IR分诊
使用Deep Eye进行回归测试
Install
npx skills add zakirkun/deep-eye --skill blue-team -g -y
SKILL.md
Frontmatter
{
"name": "blue-team",
"description": "Blue team defense using Deep Eye outputs for detection engineering, IR content, and hardening. Use for blue team, SOC, SIEM, detection engineering, threat hunting, IR triage, hardening, \/blue-team."
}
Deep Eye — Blue Team Skill
Deep Eye = controlled attack corpus for detection and control validation.
Generate corpus
python deep_eye.py -u https://STAGING -v --formats json,sarif
Useful noisy checks: sql_injection, xss, ssrf, ssrf_cloud, log4shell, lfi, crlf_injection, smuggling modules.
Detection loop
- Take High finding (
payload,url,type) - Write SIEM/WAF rule
- Replay scan / single request
- Measure FPs
- Document owner
Control validation
| Finding | Control |
|---|---|
| IDOR/BOLA | Object-level authz |
| JWT | Alg lockdown, signature verify |
| SSRF | Egress / metadata block |
| XSS | CSP + encoding |
| Secrets | Scanner + CI secret scan |
Retest
python deep_eye.py -u URL --retest-new reports/prior.json
Rules
Do not disable prod controls only to silence scans; coordinate SOC windows.
Version History
- dc5059c Current 2026-08-20 02:49
