Agent Skills
› zakirkun/deep-eye
› blue-team
blue-team
GitHub基于 Deep Eye 攻击语料进行蓝队防御，涵盖检测工程、SIEM/WAF 规则编写、威胁狩猎及系统加固。提供从生成语料到验证控制措施的全流程指南。
触发场景
编写安全检测规则
安全事件响应与排查
系统安全加固
漏洞复测与验证
安装
npx skills add zakirkun/deep-eye --skill blue-team -g -y
SKILL.md
Frontmatter
{
"name": "blue-team",
"description": "Blue team defense using Deep Eye outputs for detection engineering, IR content, and hardening. Use for blue team, SOC, SIEM, detection engineering, threat hunting, IR triage, hardening, \/blue-team."
}
Deep Eye — Blue Team Skill
Deep Eye = controlled attack corpus for detection and control validation.
Generate corpus
python deep_eye.py -u https://STAGING -v --formats json,sarif
Useful noisy checks: sql_injection, xss, ssrf, ssrf_cloud, log4shell, lfi, crlf_injection, smuggling modules.
Detection loop
- Take High finding (
payload,url,type) - Write SIEM/WAF rule
- Replay scan / single request
- Measure FPs
- Document owner
Control validation
| Finding | Control |
|---|---|
| IDOR/BOLA | Object-level authz |
| JWT | Alg lockdown, signature verify |
| SSRF | Egress / metadata block |
| XSS | CSP + encoding |
| Secrets | Scanner + CI secret scan |
Retest
python deep_eye.py -u URL --retest-new reports/prior.json
Rules
Do not disable prod controls only to silence scans; coordinate SOC windows.
版本历史
- dc5059c 当前 2026-08-20 02:49
