Skill UI

This guide teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous, comprehensive threat detection across entire AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting various finding severity levels, and building robust, automated incident response playbooks using EventBridge and AWS Lambda for immediate containment actions.

This utility implements comprehensive Cloud Workload Protection (CWPP) by monitoring compute workloads on cloud instances (EC2/GCE). It provides runtime security controls, detecting process anomalies, unauthorized binary execution, cryptomining activity, and suspicious network connections using AWS and Google APIs. Ideal for establishing robust security postures and meeting compliance requirements.

This tool guides the deployment and configuration of the Dragos Platform for critical Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages over 600 industrial protocol parsers and advanced threat intelligence to detect sophisticated attacks (e.g., VOLTZITE, GRAPHITE). Use it for building an OT Security Operations Center (SOC), asset discovery, and vulnerability management in industrial settings, integrating alerts with enterprise SIEMs.

Automate comprehensive vulnerability management by deploying and operating Greenbone/OpenVAS. This skill guides the use of the python-gvm library to programmatically manage the entire scanning lifecycle: creating scan targets, executing complex vulnerability scans via the Greenbone Management Protocol (GMP), monitoring progress, and parsing detailed XML reports into actionable JSON findings. Ideal for security assessments and compliance checks.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

Zeek is a powerful, open-source network security monitoring framework that generates high-fidelity structured logs and metadata from raw network traffic. This skill covers deploying Zeek, analyzing various protocol logs (HTTP, DNS, TLS, etc.), writing custom detection scripts to identify anomalies, and integrating resulting security insights with SIEM platforms for comprehensive threat detection and forensic investigation.

This skill covers the end-to-end automation of SSL/TLS X.509 certificate management. It guides users in generating Certificate Signing Requests (CSRs), monitoring expiration, automating renewal via ACME protocol (e.g., Let's Encrypt), and handling revocation checking. Essential for security assessments, incident response, and maintaining robust cryptographic infrastructure.

This tool guides the creation of actionable monitoring dashboards for observability platforms like Grafana and SigNoz. Instead of merely displaying raw metrics, it focuses on structuring data to answer critical operational questions: Is the system healthy? Where are the bottlenecks? What changes occurred? And what action should be taken? It transforms raw metrics into decision-making tools.

This tool enables deep inspection and validation of web applications by connecting to the browser's DevTools Protocol (MCP). It allows agents to perform tasks like DOM inspection, capturing console logs, monitoring network requests, profiling performance, and taking screenshots in a live environment. Essential for debugging UIs, validating API integrations, and performing end-to-end automated testing.

This skill generates deep, clickable URLs to various resources within the Arize monitoring UI. It supports linking to specific traces, spans, sessions, datasets, evaluators, and annotation configurations. It is essential for sharing specific debugging artifacts or navigating directly to key data points within the MLOps platform by requiring precise resource IDs and time ranges.

Generates migration instructions for GitHub Copilot by comparing two project states, enabling consistent transformations during migrations, refactors, or technology upgrades and documenting rules, validation, and monitoring steps.

Cross-database SQL performance optimization assistant offering query tuning, indexing strategies, pagination, batch operations, and monitoring guidance for MySQL, PostgreSQL, SQL Server, Oracle, and other relational systems.