ROLE_01 // ANALYST
The Analyst
Answers precise questions about your traffic. Protocols, flows, endpoints — with surgical accuracy.
"Which hosts sent the most DNS queries?"
"What TLS versions are in use?"
ROLE_02 // HUNTER
The Hunter
Proactively searches for threats. Beacons, exfiltration, lateral movement, C2 patterns — before you ask.
"Is there C2 beacon activity?"
"Any signs of DNS tunneling?"
ROLE_03 // WRITER
The Writer
Generates incident reports, executive summaries, and technical write-ups — ready to ship.
"Write a SOC incident report."
"Generate an executive brief."
ROLE_04 // TEACHER
The Teacher
Explains what's happening and why it matters. From L3 basics to advanced attack techniques.
"Explain this ARP anomaly."
"What does this JA3 hash mean?"
ROLE_05 // BUILDER
The Builder
Creates Wireshark filters, Zeek scripts, Sigma rules, and Snort signatures from your findings.
"Write a Sigma rule for this pattern."
"Generate a Wireshark display filter."
ROLE_06 // BRIEFER
The Briefer
Synthesizes findings into audio briefings and narrative timelines for async communication.
"Give me a 2-minute audio brief."
"Reconstruct the attack timeline."
ROLE_07 // RESPONDER
The Responder
Translates findings into immediate containment actions. Block lists, firewall rules, isolation playbooks.
"What do I block right now?"
"Give me an iptables containment rule."