Skill UI

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

API Security Posture Management (API-SPM) provides continuous, unified visibility into an organization's entire API attack surface. It automatically discovers, classifies, and risk-scores all APIs—including internal, external, and shadow endpoints. By aggregating findings from various sources (DAST, SAST, runtime logs), it helps enforce security policies, detect configuration drift, and maintain compliance across the entire API lifecycle.

Configure Azure AD Privileged Identity Management via Microsoft Graph API to enumerate eligible and active assignments, request just-in-time activations, audit logs, and enforce MFA or approval policies for zero-trust privileged access scenarios.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.

Zeek is a powerful, open-source network security monitoring framework that generates high-fidelity structured logs and metadata from raw network traffic. This skill covers deploying Zeek, analyzing various protocol logs (HTTP, DNS, TLS, etc.), writing custom detection scripts to identify anomalies, and integrating resulting security insights with SIEM platforms for comprehensive threat detection and forensic investigation.

Astro is a modern web framework designed specifically for building high-performance, content-heavy websites like blogs, documentation sites, and portfolios. Its core innovation is the Islands Architecture, which ships zero JavaScript by default, drastically improving performance and Core Web Vitals. It supports multi-framework components (React, Vue, Svelte) in a single project, making it ideal for content developers prioritizing speed and flexibility.

This guide details how to build an MCP app, which is an MCP server enhanced to serve interactive UI resources. It allows developers to render complex widgets—such as forms, pickers, dashboards, and confirmation dialogs—directly inline within a chat conversation. Learn about the architecture, host specifics, and when to use a widget versus standard text output.

This skill generates user-friendly, public-facing release notes (changelogs) for App Stores. It analyzes the raw Git history since the last tag, intelligently filtering out internal commits (like refactors, CI updates, or build scripts) and grouping visible changes into concise, benefit-focused bullet points suitable for a "What's New" section.

This agent facilitates comprehensive debugging and testing of iOS applications running on a simulated environment. It leverages XcodeBuildMCP to manage the entire lifecycle, including building, running, interacting with the UI (tap, type, gesture), taking screenshots, and capturing detailed runtime logs. Use it whenever you need to simulate real-world app testing or diagnose issues on a booted simulator.

This skill provides a comprehensive guide and structured SQL templates for performing deep forensic investigations on AWS cloud logs. It utilizes AWS Athena to query massive datasets from CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs. Ideal for detecting unauthorized access, data exfiltration, and privilege escalation during security incident response.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.