anomali AI Agent Skills
Browse 72 skills related to anomali
Wireshark Network Traffic Analysis
davila7This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
Error-Detective
sickn33Search logs and codebases for error patterns, stack traces, and anomalies. Correlates errors across systems and identifies root causes.
statistical-analysis
anthropicsApply statistical methods including descriptive stats, trend analysis, outlier detection, and hypothesis testing. Use when analyzing distributions, testing for significance, detecting anomalies, computing correlations, or interpreting statistical results.
Wireshark Network Traffic Analysis
zebbernThis skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
watch-my-money
openclawAnalyze bank transactions, categorize spending, track monthly budgets, detect overspending and anomalies. Outputs interactive HTML report.
detecting-data-anomalies
This skill empowers Claude to identify anomalies and outliers within datasets. It leverages the anomaly-detection-system plugin to analyze data, apply appropriate machine learning algorithms, and highlight unusual data points. Use this skill when the user requests anomaly detection, outlier analysis, or identification of unusual patterns in data. Trigger this skill when the user mentions "anomaly detection," "outlier analysis," "unusual data," or requests insights into data irregularities.
sentry-advanced-troubleshooting
Execute advanced Sentry troubleshooting techniques. Use when debugging complex SDK issues, missing events, source map problems, or performance anomalies. Trigger with phrases like "sentry not working", "debug sentry", "sentry events missing", "fix sentry issues".
langfuse-cost-tuning
jeremylongshoreMonitor and optimize LLM costs using Langfuse analytics and dashboards. Use when tracking LLM spending, identifying cost anomalies, or implementing cost controls for AI applications. Trigger with phrases like "langfuse costs", "LLM spending", "track AI costs", "langfuse token usage", "optimize LLM budget".
data-quality-profiler
a5c-aiProfiles data assets to assess quality dimensions, detect anomalies, and generate comprehensive data quality reports with actionable recommendations.
reasoning-abductive
aiskillstoreGenerate and evaluate explanatory hypotheses from incomplete observations. Use when diagnosing anomalies, explaining unexpected outcomes, or inferring causes from effects. Produces ranked hypotheses with evidence and confidence scores.
metrics-review
davekilleenReview key metrics and anomalies
Model Monitoring
aj-geddesMonitor model performance, detect data drift, concept drift, and anomalies in production using Prometheus, Grafana, and MLflow
Anomaly Detection
aj-geddesIdentify unusual patterns, outliers, and anomalies in data using statistical methods, isolation forests, and autoencoders for fraud detection and quality monitoring
triage-suspicious-login
dandyeTriage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.
hunt-threat
dandyeConduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation.
aws-cost-finops
ahmedasmarAWS cost optimization and FinOps workflows. Use for finding unused resources, analyzing Reserved Instance opportunities, detecting cost anomalies, rightsizing instances, evaluating Spot instances, migrating to newer generation instances, implementing FinOps best practices, optimizing storage/network/database costs, and managing cloud financial operations. Includes automated analysis scripts and comprehensive reference documentation.
analysis-tshark
AgentSecOpsNetwork protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.
user-investigation
SCStelzUse this skill when asked to investigate a user account for security issues, suspicious activity, or compliance review. Triggers on keywords like "investigate user", "security investigation", "user investigation", "check user activity", "analyze sign-ins", or when a UPN/email is mentioned with investigation context. This skill provides comprehensive Entra ID user security analysis including sign-in anomalies, MFA status, device compliance, audit logs, security incidents, Identity Protection risk, and automated reports (HTML, markdown file, or inline chat).
authentication-tracing
SCStelzUse this skill when asked to trace authentication flows, analyze SessionId chains, investigate token reuse vs interactive MFA, or assess geographic anomalies in sign-ins. Triggers on keywords like "trace authentication", "trace back to interactive MFA", "SessionId analysis", "token reuse", "geographic anomaly", "impossible travel", or when investigating suspicious sign-in locations. This skill provides forensic analysis of Entra ID authentication chains to distinguish legitimate activity from credential/token theft.
Data Anomaly Detector for Construction
datadrivenconstructionDetect anomalies and outliers in construction data: unusual costs, schedule variances, productivity spikes. Statistical and ML-based detection methods.
cwicr-bid-analyzer
datadrivenconstructionAnalyze contractor bids against CWICR benchmarks. Identify pricing anomalies, compare bid components, and support bid evaluation decisions.
sensor-data-aggregator
datadrivenconstructionAggregate and analyze IoT sensor data from construction sites. Collect data from multiple sensor types, detect anomalies, and trigger alerts for safety and quality monitoring.
panic-room-finder
curiositechExpert in residential hollow space detection, hidden room discovery, and safe room planning. Helps map house dimensions, identify anomalies suggesting hidden spaces, and safely explore potential voids. Knowledge of architectural history, construction methods, and non-destructive investigation techniques. Activate on "panic room", "hidden room", "secret room", "hollow space", "house mapping", "find hidden space", "room dimensions", "hidden door", "false wall", "priest hole", "prohibition era", "safe room". NOT for illegal entry, structural modifications without permits, or bypassing security systems.
data-researcher
404kidwizData discovery and analysis specialist focused on extracting actionable insights from complex datasets, identifying patterns and anomalies, and transforming raw data into strategic intelligence. Excels at multi-source data integration, advanced analytics, and data-driven decision support.
anomaly-detector
majesticlabs-devDetect anomalies in data using statistical and ML methods. Z-score, IQR, Isolation Forest, and time-series anomalies.
data-cleaning-and-visualization
yushui2022Automatically clean competition or scraped data (handle missing values/anomalies/formatting) and generate visualizations. Invoke when the user needs to process raw data, clean data, or create data analysis charts.
Outlier Detective
dkyazzentwatwaDetect anomalies and outliers in datasets using statistical and machine learning methods. Use for data cleaning, fraud detection, or quality control analysis.
Wireshark Network Traffic Analysis
zebbernThis skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
abductive-analyst
nealcarenAbductive analysis for qualitative interview data following Timmermans & Tavory. Guides you through a theory-first analysis that recognizes anomalies and generates novel theoretical insights through systematic puzzle exploration.
harmonica
SteadfastAsArtGravity and magnetic data processing and forward modelling using Fatiando a Terra. Use when Claude needs to: (1) Compute gravity forward models (point masses, prisms, tesseroids), (2) Apply terrain/Bouguer corrections, (3) Grid scattered potential field data with equivalent sources, (4) Perform upward/downward continuation, (5) Calculate magnetic anomalies from magnetized bodies, (6) Apply derivative filters (gradients, tilt angle), (7) Process regional or local gravity surveys.
pyrolite
SteadfastAsArtGeochemistry data analysis and visualization for igneous, metamorphic, and sedimentary rocks. Use when Claude needs to: (1) Create ternary diagrams for compositional data, (2) Plot REE spider diagrams with normalization, (3) Build TAS or other classification diagrams, (4) Apply log-ratio transforms to compositional data, (5) Calculate CIPW norms, (6) Generate Harker variation diagrams, (7) Compute element ratios and anomalies.
analyze-chart
amplitudePerforms deep analysis of a specific Amplitude chart to explain trends, anomalies, and likely drivers. Use when a metric looks unusual, investigating a spike or drop, or understanding the "why" behind numbers.
exploratory-data-analysis
jackspaceAnalyze datasets to discover patterns, anomalies, and relationships. Use when exploring data files, generating statistical summaries, checking data quality, or creating visualizations. Supports CSV, Excel, JSON, Parquet, and more.
Clash Doctor
majiayu000Diagnose Clash proxy and network connection issues. Use when users encounter unreachable network, proxy not working, GitHub/Google timeouts, DNS anomalies, TUN mode failures, and similar network problems.
log-analyzer
TerminalSkillsAnalyze application logs, server logs, and error traces to identify root causes, patterns, and anomalies. Use when debugging production incidents, investigating error spikes, parsing crash reports, or correlating events across multiple log sources. Trigger words: logs, errors, stack trace, crash, exception, debug, incident, 500 errors, timeout, latency spike.
analyze-dashboard
amplitudeDeeply analyze Amplitude dashboards by analyzing key charts, surfacing top areas for concern and takeaways, identify anomalies, then explain changes using customer feedback trends
detecting-data-anomalies
BbgnsurfTechIdentify anomalies and outliers in datasets using machine learning algorithms. Use when analyzing data for unusual patterns, outliers, or unexpected deviations from normal behavior. Trigger with phrases like "detect anomalies", "find outliers", or "identify unusual patterns".
buildbuddy-usage-analysis
sluongngAnalyze BuildBuddy billing usage and trends data, fetch GetUsage/GetTrend/GetStatHeatmap/GetStatDrilldown/SearchInvocation/SearchExecution data, compare periods, spot anomalies, and recommend cost-saving actions while protecting API keys.
deploy-analysis
lacolacoAnalyzes GitHub Actions deployment execution history to understand deployment time trends and detect anomalies. Used when referring to "deploy analysis" or "deploy performance".
Wireshark Network Traffic Analysis
agent-skills-hubThis skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
error-detective
agent-skills-hubSearch logs and codebases for error patterns, stack traces, and anomalies. Correlates errors across systems and identifies root causes. Use PROACTIVELY when debugging issues, analyzing logs, or investigating production errors.
evaluating-threat-intelligence-platforms
mukul975Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
detecting-golden-ticket-attacks-in-kerberos-logs
mukul975Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
time-series-analyst
organvm-iv-taxisAnalyzes time-series data for patterns, trends, seasonality, and anomalies, with forecasting using statistical and machine learning methods.
analyzing-dns-logs-for-exfiltration
mukul975Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
detect-anomalies-aiops
pjt222Implement AI-powered anomaly detection for operational metrics using time series analysis (Isolation Forest, Prophet, LSTM), alert correlation, and root cause analysis. Reduce alert fatigue by intelligently identifying true anomalies in system metrics, logs, and traces. Use when operations teams are overwhelmed by alert volume, when detecting complex multi-metric anomalies beyond static thresholds, when seasonal patterns make thresholds ineffective, or when needing to predict issues proactively before they impact users.
performing-active-directory-compromise-investigation
mukul975Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.
detecting-cryptomining-in-cloud
mukul975This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
