Skill UI

Automates Datadog monitoring workflows via Composio’s Rube MCP, letting you query metrics, search logs, manage monitors and dashboards, and create events or downtimes after connecting to the MCP toolkit and tools list.

A comprehensive, expert-level workflow for debugging complex software issues in production environments. This skill guides users through initial triage, advanced observability data collection (APM, distributed traces, logs), intelligent hypothesis generation, and full root cause analysis. Use it when dealing with intermittent failures, performance bottlenecks, or needing a complete fix and prevention plan.

This comprehensive guide catalogs common anti-patterns and mistakes when deploying applications on Vercel. It covers critical architectural areas such as secret management (preventing key exposure), optimizing serverless function performance (cold start, timeouts), adhering to Edge Runtime standards, and resolving configuration errors. Use this skill for code reviews, security audits, and onboarding new developers to ensure best deployment practices.

A comprehensive enterprise-grade security engine designed to discover, classify, protect, and govern all credentials, API keys, and secrets across the entire application lifecycle. It provides continuous governance by auditing code repositories, CI/CD pipelines, runtime logs, and infrastructure configurations to prevent exposure and enforce least privilege principles. Ideal for implementing DevSecOps best practices.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

A comprehensive digital forensics technique used to investigate removable media usage. It parses artifacts from Windows registry (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs to track which USB devices were connected, when they were used, and establishing a timeline for potential data exfiltration or insider threat activity.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

Analyzes Windows Security EVTX logs to detect Kerberos golden ticket assaults by correlating event IDs 4768, 4624, and 4672, flagging long-lived TGTs, privilege escalations without group changes, SID inconsistencies, and outputting a timeline-based report.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This skill guides threat hunters in detecting MITRE ATT&CK T1098 account manipulation techniques. It focuses on analyzing Windows Security Event Logs (like 4738, 4728) to uncover shadow administration creation, suspicious group membership changes, SID history injection, and unauthorized credential modifications, crucial for incident response and building robust detection rules.