Skill UI

This skill guides the implementation of full disk encryption using Microsoft BitLocker on Windows endpoints. It covers best practices for deploying encryption via GPO, Intune, and command line, ensuring data-at-rest protection. Use this when meeting compliance requirements (PCI, HIPAA) or securing mobile workstations against physical loss or theft.

This guide details the implementation of the three core email authentication protocols: SPF, DKIM, and DMARC. By configuring these DNS records, users can prevent domain spoofing, ensure message integrity, and define strict policies (quarantine/reject) for unauthenticated emails, drastically reducing exposure to phishing and spoofing attacks.

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

A comprehensive guide to deploying and configuring Wazuh SIEM/XDR for robust endpoint detection and response. This skill covers agent authentication and management via API, creating custom decoders and rules, querying security alerts, and validating rule logic using logtest functionality.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

This skill guide details the implementation of envelope encryption using AWS Key Management Service (KMS). It outlines the secure process of using a Data Encryption Key (DEK) to encrypt data locally, and subsequently protecting that DEK with a KMS-managed Key Encryption Key (KEK). This method is crucial for encrypting large data volumes on AWS, significantly reducing direct KMS API calls, improving performance, and maintaining compliance with strict security standards.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

This guide details the implementation of GCP Binary Authorization, a crucial deploy-time security control. It ensures that only trusted, verified container images are deployed on GKE or Cloud Run by requiring cryptographic attestations. Learn how to set up KMS-backed attestors, configure policies, and integrate the validation process into your CI/CD pipeline to enforce robust supply chain integrity.

This guide teaches how to implement and audit Google Cloud Platform (GCP) VPC firewall rules using gcloud. It covers creating restrictive ingress and egress rules, enforcing network segmentation using tags and service accounts, and auditing for overly permissive settings. Ideal for compliance, zero-trust architectures, and responding to security findings.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

This guide details how to implement HashiCorp Vault's dynamic secrets engine. It automates the generation, lease management, and rotation of short-lived credentials for databases (e.g., PostgreSQL, MySQL), AWS IAM, and PKI certificates. This method eliminates the use of static, hardcoded secrets, enforcing zero-trust principles and meeting stringent compliance mandates like PCI-DSS.

This guide details the deployment of deception technologies, including canary files and honeypot shares, to detect ransomware activity at its earliest stages. It outlines configuring file integrity monitoring (FIM) and using specialized tokens to trigger alerts when ransomware attempts encryption or performs lateral movement, significantly enhancing security posture beyond standard EDR.