actioner

Threat-intelligence detection engineering in Claude Code. On-demand: research a threat and generate Sigma/YARA/Snort/Suricata rules (PoC/advisory-specific by default, opt-in behavioral TTP), each labeled compile-status × confidence and written to convert to Splunk/CrowdStrike, gated by a critic before delivery. Autonomous: a daily routine scans your CTI feeds and auto-generates committed detections for items that warrant one.