Skill UI

Tetragon utilizes eBPF technology to provide deep, low-overhead security observability and runtime enforcement directly within Kubernetes clusters. It monitors system calls, process execution, file access, and network connections at the kernel level, allowing users to detect or block dangerous activities like container escapes or privilege escalation, ensuring robust cluster security and compliance.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This skill guides the implementation of Security Orchestration, Automation, and Response (SOAR) workflows using platforms like Splunk Phantom. It automates the entire incident lifecycle, including alert triage, IOC enrichment (via VirusTotal, CrowdStrike), containment actions, and ticket creation (ServiceNow). Ideal for SOC teams needing to reduce Mean Time To Respond (MTTR) and standardize complex security procedures across multiple tools.

A comprehensive guide for implementing a highly secure and reliable centralized logging pipeline using rsyslog. This method utilizes TLS encryption via X.509 certificate authentication and GnuTLS stream drivers, ensuring all log data is securely transmitted. The guide covers per-host log segregation, robust log rotation, and disk-assisted queueing for high-availability log infrastructure, making it ideal for compliance and security operations.

This guide details configuring ModSecurity WAF and OWASP Core Rule Set (CRS) for comprehensive web application security auditing. It covers essential steps such as initial deployment, rule tuning to minimize false positives, configuring detailed audit logging, and integrating logs into SIEM systems for robust threat detection.

This guide details how to implement Zero Standing Privilege (ZSP) using CyberArk Secure Cloud Access (SCA). It eliminates persistent admin roles in AWS, Azure, and GCP by granting ephemeral, scoped, and time-bound access. Access is governed by the TEA framework (Time, Entitlements, Approvals), ensuring least privilege and robust security compliance for critical cloud environments.

Configure NextDNS as an encrypted DNS resolver (DoH/DoT) to enforce zero trust principles at the network layer. This skill guides users on deploying real-time threat intelligence filtering, blocking malicious domains, preventing cryptojacking, detecting DNS rebinding, and enforcing strict organizational DNS policies across endpoints, aligning with modern cybersecurity standards.

This guide details implementing Zero Trust Network Access (ZTNA) across major cloud providers (AWS, Azure, GCP). It replaces traditional VPNs by enforcing identity-based, context-aware access controls using identity-aware proxies and micro-segmentation. Use it to secure cloud workloads, limit lateral movement, and comply with modern security standards like BeyondCorp.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A comprehensive guide for incident responders detailing how to investigate Active Directory (AD) compromises. This skill covers analyzing critical components like NTDS.dit integrity, detecting Kerberos anomalies (Golden/Silver Tickets), tracing lateral movement, and identifying Group Policy abuse to reconstruct attacker activity and determine the full scope of a breach.

A comprehensive guide to detecting and mitigating advanced Adversary-in-the-Middle (AiTM) phishing attacks, which bypass Multi-Factor Authentication (MFA) using reverse proxies (e.g., Evilginx, EvilProxy). Learn defensive strategies including implementing FIDO2, configuring Conditional Access policies, and monitoring session hijacking indicators in SIEM/Web Proxies.