Skill UI

Proactively hunt for Advanced Persistent Threats (APTs) by building hypothesis-driven searches across telemetry, network logs, and memory artifacts, using MITRE ATT&CK, Velociraptor, osquery, Zeek, and Sigma-compatible playbooks to validate or rule out known TTPs.

Crafts OT-focused incident response playbooks aligned with PICERL, IEC 62443, and NIST 800-82 to coordinate IT SOC, OT engineering, and plant ops during ICS crises while covering ransomware, safety, and recovery workflows.

Automates SOC triage and incident response workflows by using Splunk SOAR playbooks to enrich alerts, enforce analyst gates, and orchestrate containment via tool integrations.

Automates phishing incident response by parsing suspicious emails, creating Splunk SOAR containers and artifacts via the REST API, and triggering investigation playbooks while polling for results to deliver summarized verdicts.

Automates SOC workflows with Palo Alto Cortex XSOAR by defining incident playbooks, integration-driven enrichment, and containment steps for phishing and other incidents to cut MTTR and streamline analyst actions.

Guides SOC teams through discussion-based tabletop exercises that simulate security incidents, validate IR playbooks, train analysts, and rehearse cross-functional communication so you can test procedures without touching production systems.