Skill UI

Tracks phishing incidents from the initial user report through header analysis, URL/attachment detonation, scope assessment, and containment via SOC tools such as Splunk, Microsoft Defender, and sandbox services.

Analyze Zeek network logs like conn.log and SMB/NTLM traces to surface lateral movement techniques such as SMB admin share access, DCE/RPC remote service execution, NTLM account spray, Kerberos anomalies, and large internal data transfers so defenders can hunt and alert on spreading compromise.