# arttapon1

> Open-source publisher. Listings imported from github.com/arttapon1 — credited to the original author with their license.

- **Listings:** 3
- **Total installs:** 0
- **Profile:** https://agentstack.voostack.com/s/arttapon1
- **Website:** https://github.com/arttapon1

## Published listings

- [Siem Detection Engineer](https://agentstack.voostack.com/l/skill-arttapon1-defensive-soc-skills-siem-detection-engineer) — Skill · Free · security-reviewed — `agentstack add skill-arttapon1-defensive-soc-skills-siem-detection-engineer`
  Analyze logs, IOCs, and attack behavior to design high-fidelity SIEM detection rules. Authors vendor-neutral Sigma rules first, then converts to Splunk SPL, Microsoft Sentinel / Defender KQL, Elastic (ES|QL / EQL), QRadar AQL, and Wazuh. Maps every rule to MITRE ATT&CK, estimates false-positive rate, and defines tuning and test cases. Use when the user mentions 'detection rule,' 'SIEM rule,' 'det…
- [Soar Playbook Builder](https://agentstack.voostack.com/l/skill-arttapon1-defensive-soc-skills-soar-playbook-builder) — Skill · Free · security-reviewed — `agentstack add skill-arttapon1-defensive-soc-skills-soar-playbook-builder`
  Design and generate SOAR automation playbooks that enrich alerts with threat intelligence (VirusTotal, Group-IB, AbuseIPDB, OTX) and orchestrate automated response via device APIs — blocking IOCs on firewalls (Palo Alto, Fortinet, Check Point), WAFs (Cloudflare, AWS WAF, F5), IPS, DLP, and EDR. Produces vendor-neutral playbook definitions with decision logic, approval gates, rollback, and safety…
- [Ir Report Builder](https://agentstack.voostack.com/l/skill-arttapon1-defensive-soc-skills-ir-report-builder) — Skill · Free · security-reviewed — `agentstack add skill-arttapon1-defensive-soc-skills-ir-report-builder`
  Analyze security logs and incident data to reconstruct an attack timeline, build an incident response plan following NIST SP 800-61 / SANS PICERL, and produce a detailed technical report plus a concise executive summary. Use when the user mentions 'IR report,' 'incident response report,' 'incident analysis,' 'log analysis for incident,' 'attack timeline,' 'root cause analysis,' 'executive summary…

---
Seller on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Install any with `agentstack add <slug>`.