umbrasec-labs/umbra-blue

Defensive security skills for Claude - drop-in SKILL.md files that turn Claude into an evidence-backed blue team analyst.
Overview • Blue Team Mapper • Quickstart • Two tiers • Categories • Skill Index • Coverage • Roadmap • Contributing
## Overview
umbra-blue is a library of defensive security skills for the Claude Skills system. It is the blue team counterpart to claude-red: 78 of claude-red's 79 offensive skills are paired with the defensive skill that answers them, in the same category folder. The one gap, offensive-netexec, needs a new skill and is listed in COVERAGE.md. Where claude-red teaches Claude how a technique is executed, umbra-blue teaches Claude how to see it, hunt it, and shut it down.
Each skill is a structured SKILL.md that primes Claude with detection, hunting, and hardening methodology for one threat: the log sources and event IDs that carry the signal, what to alert on, how to tune out false positives, how to hunt for the quiet variant, and which controls shrink the attack surface, mapped to MITRE ATT&CK and D3FEND. Skills load on demand from their description triggers, so you only pay context for the skill you need.
What makes it different: most blue team skill collections teach method, such as how to write a Sigma rule. umbra-blue's Tier 1 skills ship the tuned rule itself, drawn from published UMBRASEC incident research and reused byte for byte from the UMBRASEC sigma-pack, with tuning and false-positive notes. Every skill says plainly which tier it is in, and none fabricates a rule or a citation.
Use cases: SOC triage and alert investigation, detection engineering, threat hunting, hardening reviews, purple team exercises against claude-red, incident response support, and defender training.
Defensive in scope. Skills explain a technique only to the depth needed to detect and mitigate it. No exploit code, payloads, or offensive tooling ship from here.
## Blue Team Mapper
Every skill has its own page in the Blue Team Mapper, the UMBRASEC interactive map of defensive operations. Use it to see where a skill fits before you load it, or to plan a purple team exercise. A skill's page shows:
the ATT&CK techniques the skill covers and the claude-red skills it answers
the UMBRASEC sigma-pack rules it inlines, plus other UMBRASEC rules for the same techniques
Where the skill's techniques are in the mapper matrix, the page also shows:
the matching matrix rows
the response flow chains those rows lead to
your own coverage rating for each row, if you set one on the mapper's Coverage page
The matrix covers a focused set of techniques, so many skills have no matrix rows yet. Their pages still list the techniques and any matching rules.
Follow the map link next to any skill in the Skill Index or COVERAGE.md. Each page lives at https://umbrasec-labs.github.io/BlueTeamMapper/skills/ , and claude-skills.json carries the same URL in each skill's mapper field.
## Quickstart
### Claude Code (recommended)
Claude Code discovers skills at ~/.claude/skills/ /SKILL.md, one folder per skill, so use the installer. It flattens the category tree into that layout.