Skill UI

This guide details how to build automated threat intelligence enrichment pipelines within Splunk Enterprise Security. By leveraging the Threat Intelligence Framework, users can ingest, normalize, and correlate Indicators of Compromise (IOCs) from diverse external sources (such as TAXII, CSV, and custom APIs). The process uses KV Store collections and lookup searches to enrich raw security events with critical threat context, significantly reducing triage time for SOC teams.

MISP (Malware Information Sharing Platform) is an open-source platform designed for gathering, storing, and correlating Indicators of Compromise (IOCs). This skill guides users through deploying MISP using Docker, configuring various threat feeds (MISP, TAXII, CSV), and utilizing the PyMISP Python API. It enables the building of automated pipelines to aggregate diverse threat data, such as IP addresses, domains, and hashes, for enhanced security operations.

This skill automates the generation of high-quality, publication-ready figures and comparison tables from raw experimental data (CSV, JSON, etc.). It supports various plot types, including line plots, bar charts, scatter plots, heatmaps, and box plots, ensuring consistent style (DPI 300, PDF format) suitable for academic submissions. Users provide a figure plan and raw data, and the system generates the necessary code to visualize results.

This skill provides a comprehensive automation solution for conducting red team phishing simulations using the Python gophish library. It streamlines the entire campaign lifecycle, including creating sophisticated email templates with tracking pixels, configuring SMTP profiles, importing user groups from CSV, launching targeted attacks, and generating detailed reports on open rates, click-through rates, and credential submission statistics for robust security awareness assessments.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.

Analyzes Excel and CSV uploads with DuckDB, inspecting schemas, running SQL, summarizing statistics, and exporting results so users can explore structured data efficiently.

Generates a standup-ready summary that combines today’s calendar meetings with open tasks via the GWS workflow command, offering JSON, table, YAML, or CSV output to keep updates concise and ready for reporting.

Fetches this week’s meeting agenda and unread Gmail count via `gws workflow +weekly-digest`, delivering a read-only productivity snapshot that supports json/table/yaml/csv outputs for fast triage.

Generates a single formula-driven Excel dashboard from CSV/tabular data, complete with KPI cards, charts, sparklines, and conditional formatting so analysts can instantly review metrics and share an executive-ready .xlsx output.

Exports a Google Sheets spreadsheet to CSV via gws commands for local backup or downstream processing, using sheets metadata and drive export or direct read operations.

This skill provides comprehensive commands for creating, managing, versioning, and querying structured datasets within the Arize platform. It covers dataset CRUD operations, appending examples, and exporting data in various formats (JSON, CSV, Parquet) using the `ax` CLI. Ideal for preparing test data, generating evaluation examples, or retrieving golden datasets for LLM development and model testing.

Guides network operators through creating, tuning, and validating RFC 8805-compliant CSV geofeeds with opinionated best practices that improve accuracy, completeness, and usability for publicly routable IP space.