Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsCyber Attack Chain Analysis
Transform incident timelines into structured Cyber Kill Chain mappings and high-impact defensive roadmaps.
$12
cyber-attack-chain-analysis
Example session with this skill installed
Analyse this incident timeline against the Cyber Kill Chain and produce a phase-by-phase detection gap report for security leadership. The incident involved spearphishing delivery, a malicious macro, PowerShell execution, lateral movement via remote management tools, and data staging before exfiltration was detected. I have the alert log and the case notes from the investigation.
- Read your context and instructions
- Compiled the cyber-attack-chain-analysis
The skill produces a structured report mapping each observed event to a Cyber Kill Chain phase with detection status (detected, missed, blocked, or unknown) and first detection point. It includes a phase-by-phase defensive gap assessment, a MITRE ATT&CK technique linkage table where evidence supports it, and a prioritised control improvement roadmap. An executive summary and a chronological event timeline are included, along with evidence gaps and validation questions for unresolved phases.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Stop Guessing, Start Mapping
Modern incident response requires more than just a list of alerts; it demands a structured understanding of how an adversary progressed through your environment. This skill provides a rigorous, evidence-based analysis of intrusion activity using the Cyber Kill Chain framework. It transforms fragmented logs and timeline notes into a strategic defensive roadmap.
Advanced Analytical Depth
Unlike basic prompting, this skill enforces strict evidentiary standards. It distinguishes between confirmed facts and assumptions, identifies the 'first point of detection,' and highlights exactly where your visibility failed. It doesn't just list what happened; it analyzes why it wasn't stopped sooner.
Framework & Tool Agnostic
- Frameworks: Primary mapping to Cyber Kill Chain with secondary support for MITRE ATT&CK® tactics and techniques.
- Enterprise Integration: Adaptable to any security stack (SIEM, EDR, XDR) provided by the user.
- Strategic Output: Generates executive summaries, detection gap registers, and prioritized remediation roadmaps.
Why This Skill?
Security analysts often struggle to translate technical findings into leadership-ready reports. This skill automates the heavy lifting of phase categorization and gap analysis while maintaining high-fidelity security standards, ensuring your post-incident reviews are objective, exhaustive, and actionable.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install