Skill UI

Use Claroty xDome’s passive and active monitoring flows to catalog ICS/OT assets—including PLCs, HMIs, RTUs, and network devices—via Claroty Edge, CMDB integrations, and communication maps for auditing and risk assessment.

Use kube-bench to audit Kubernetes clusters against CIS benchmarks, covering control plane, etcd, nodes, and RBAC with automated reports and CI/CD integration.

Guides operators through auditing etcd encryption, TLS transport, access controls, backup protection, and network isolation in Kubernetes clusters so secrets stay shielded even if the control plane is targeted.

Analyze Linux system logs (syslog, auth.log, kern.log, systemd journal, audit records, cron and application logs) to reconstruct user sessions, detect unauthorized access, and build event timelines for incident response and security assessments.

Step-by-step guidance for auditing HTTP security headers—CSP, HSTS, frame protection, cookie flags, and other browser controls—to spot missing or misconfigured protections during authorized assessments, CI/CD checks, or compliance reviews.

A guided workflow for auditing AWS Lambda, Azure Functions, and GCP Cloud Functions to catch permissive execution roles, exposed secrets, and missing runtime protections before deployment.

Audits service accounts across Active Directory, cloud platforms, databases, and applications to spot orphaned, over-privileged, or non-compliant identities, assess rotations, and document dependencies for remediation.

Guides teams through designing, implementing, and evidencing SOC 2 Type II controls aligned with the AICPA Trust Services Criteria, covering scoping, control mapping, evidence collection, remediation, and audit collaboration for a six- to twelve-month examination.

Performs forensic analysis on SQLite databases by reading headers, freelist chains, WAL files, and unallocated pages to recover deleted records and extract evidence from browsers, messaging apps, and mobile storage, aiding incident response and security audits.

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

Simulates and detects software supply chain attacks by checking typosquatting risks with Levenshtein distance, probing dependency confusion across registries, verifying package hashes, and running pip-audit vulnerability scans for security assessments.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.