executing-plans
executing-plans
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available
analyzing-linux-audit-logs-for-intrusionParse and analyze Linux auditd logs to detect intrusion indicators including unauthorized file access, privilege escalation, syscall anomalies, and suspicious process execution using ausearch and Python.
Independent GitHub snapshot · Automated classification · Original documentation governs
Parse auditd logs to detect file access violations, privilege escalation, suspicious syscalls, and unauthorized process execution.