Skill UI

Production-grade Langfuse architecture patterns for building scalable LLM observability, covering singleton SDK setup, trace context propagation, queue-based ingestion, multi-environment configuration, and service mesh tracing so teams can design reliable tracing pipelines.

Guides teams through setting up PostHog observability with ingestion health checks, flag latency tracking, billing-aware volume monitoring, alerts for anomalies, and dashboards for key metrics and API performance.

Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR platform for centralized operations across AWS, Azure, and GCP; configure data connectors for multi-cloud log ingestion, author KQL detection rules, automate Logic Apps response playbooks, and hunt threats over petabyte-scale telemetry.

Automates ingestion of STIX/TAXII and open-source threat feeds into SIEM and detection platforms, normalizing, deduplicating, and scoring IOCs so SOC teams can match indicators in real time.

Guides deploying a CTI stack using MISP, OpenCTI, TheHive, and Cortex plus storage/messaging services, covering Docker composition, feed ingestion, enrichment, and SIEM integration for unified threat intelligence operations.

Deploys osquery across Windows, macOS, and Linux to collect SQL-based views of processes, ports, software, and configuration, supporting threat hunting, compliance checks, and centralized fleet visibility via FleetDM or SIEM ingestion.

Deploys Zeek as a passive network security monitor to capture traffic at chokepoints, produce structured logs, and run custom detection scripts for anomalies, enabling SIEM ingestion and threat hunting during incident response.

Guides defenders through detecting and responding to Adversary-in-the-Middle phishing attacks that leverage reverse proxy kits such as EvilProxy, Evilginx, and Tycoon, covering prerequisites (MFA, SIEM ingestion, conditional access), detection rules, proxy monitoring, and post-compromise validation.