Skill UI

This skill utilizes the Microsoft Graph API to parse Office 365 Unified Audit Logs for security incident investigation. It is designed to detect critical indicators of account compromise, including the creation of suspicious email forwarding rules, unauthorized mailbox delegation changes, suspicious OAuth application consent grants, and other signs related to Business Email Compromise (BEC).

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

This guide provides a comprehensive methodology and technical approach for detecting malicious email forwarding rules. It is crucial for threat hunting, incident response, and proactive security assessments to identify persistent access mechanisms used by adversaries for intelligence collection and Business Email Compromise (BEC) attacks. It outlines necessary prerequisites, workflow steps, and key threat indicators (T1114).

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.