forensics plugin
Digital forensics and incident response framework with 14 specialized agents covering target profiling, evidence acquisition, log/memory/container/cloud analysis, IOC extraction, and reporting.
How to install the forensics plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add jmagly/aiwg
/plugin install forensics@aiwgWhat's inside forensics
34 parts read from the plugin's own files.
Agents 13
Call as @agent-forensics:name- @agent-forensics:cloud-analyst
No description in the file.
- @agent-forensics:container-analyst
No description in the file.
- @agent-forensics:forensic-acquisition-agent
No description in the file.
- @agent-forensics:forensics-orchestrator
No description in the file.
- @agent-forensics:ioc-analyst
No description in the file.
- @agent-forensics:log-analyst
No description in the file.
- @agent-forensics:memory-analyst
No description in the file.
- @agent-forensics:network-analyst
No description in the file.
- @agent-forensics:persistence-hunter
No description in the file.
- @agent-forensics:recon-agent
No description in the file.
- @agent-forensics:reporting-agent
No description in the file.
- @agent-forensics:timeline-builder
No description in the file.
- @agent-forensics:triage-agent
No description in the file.
Skills 21
Claude loads it when the task matches- cloud-forensics
No description in the file.
- container-forensics
No description in the file.
- evidence-preservation
No description in the file.
- exposure-analysis
No description in the file.
- forensics-acquire
No description in the file.
- forensics-hunt
No description in the file.
- forensics-investigate
No description in the file.
- forensics-ioc
No description in the file.
- forensics-profile
No description in the file.
- forensics-quickref
No description in the file.
- forensics-report
No description in the file.
- forensics-status
No description in the file.
- forensics-timeline
No description in the file.
- forensics-triage
No description in the file.
- ioc-extraction
No description in the file.
- linux-forensics
No description in the file.
- log-analysis
No description in the file.
- memory-forensics
No description in the file.
- sigma-hunting
No description in the file.
- supply-chain-forensics
No description in the file.
- target-profiling
No description in the file.
Using forensics in Claude Code
Ask for an agent by name:
@agent-forensics:cloud-analyst
@agent-forensics:container-analystSkills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update forensics@aiwg
- Refresh the marketplace
- /plugin marketplace update aiwg
- Turn it off for now
- /plugin disable forensics@aiwg
- Remove it
- /plugin uninstall forensics@aiwg
forensics plugin questions
How do I install the forensics plugin?
In Claude Code run /plugin marketplace add jmagly/aiwg, then /plugin install forensics@aiwg.
What does the forensics plugin include?
forensics bundles 13 agents, 21 skills.
Which agents come with forensics?
cloud-analyst, container-analyst, forensic-acquisition-agent, forensics-orchestrator, ioc-analyst, log-analyst +7. Call one with @agent-forensics:cloud-analyst.
How do I update or remove the forensics plugin?
Update it with claude plugin update forensics@aiwg in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall forensics@aiwg.