### [Detection Agent Harness](https://github.com/tresscross/detection-agent-harness) A Claude Code plugin that runs the detection engineering lifecycle with a coding agent: **draft → validate → test → submit**. It ships no code, only commands, skills and a guide. You point it at your own SIEM, rule format, linter and git host through a `DETECTION.md` file in your rules repo. The agent handles the judgment calls, then stops at a pull request so a human makes the merge, and the merge is the deploy. Write-up: [[Using coding harnesses to streamline detection engineering]]. ### [NG-SIEM Detection-as-Code](https://github.com/tresscross/ngsiem-detection-as-code) Detection-as-code for CrowdStrike Falcon Next-Gen SIEM correlation rules. Every rule is a reviewable YAML file. CI validates the schema, MITRE mappings and CQL format, posts a plan against your Falcon tenant on each merge request, and applies the change after merge. It also includes a bootstrap importer to pull existing tenant rules into YAML, drift detection for edits made in the Falcon UI, and a coverage summary by ATT&CK technique. ### [Cloud Detection Chokepoints](https://github.com/tresscross/cloud-detection-chokepoints) A catalog of the control-plane API calls an attacker can't avoid on the way to an outcome, with detections anchored to them. It covers 58 chokepoints across AWS CloudTrail, GCP Cloud Audit Logs and Azure Activity Log, spanning 10 ATT&CK tactics. Each entry is tiered by how well it's backed by real-world incidents. It applies the [detection-chokepoints](https://github.com/iimp0ster/detection-chokepoints) methodology, originally built for endpoints, to the cloud. Write-up: [[Cloud Control-Plane Chokepoints A Threat-Intel-Backed Field Guide]]. ### [AWS IAM Policy Analyzer](https://accessaudit.cloud/) Built a simple webpage that will break down AWS IAM policy templates into a readable format. ### [Yara-L Rule Repository](https://yaralrules.com/) Inspired by [KQLSearch](https://www.kqlsearch.com/), I built a Yara-L rule repository to help compile public rules into a tagged and queryable database for other teams who use Chronicle as their primary SIEM and detection engine. ### [SANS Index Creator](https://indexer.tresscross.blog/) Inspired by [Voltaire](https://legacy.voltaire.publickey.io/), this application allows you to input rows containing a page number, a book, a title, and a description and will allow you to download in one of several formatted ways. Following Lesley Carhart's [guide to preparing for SANS exams](https://tisiphone.net/2015/08/18/giac-testing/) led me to want something like Voltaire but the export feature was broken and is no longer being support.