Skill UI

Automates SIEM rule generation within advanced security workflows, guiding through industry best practices, compliance checks, and threat modeling to deliver production-ready configurations verified against common standards.

This skill provides a comprehensive framework for ingesting, normalizing, and enriching threat intelligence (CTI) from multiple structured and unstructured sources. It guides users through scoring feeds, converting heterogeneous IOC formats (like OpenIOC, YARA) into the standardized STIX 2.1 format, and enriching indicators using external services (e.g., VirusTotal, PassiveTotal). Ideal for building robust, automated threat detection pipelines for SIEM and EDR systems.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This skill facilitates the creation of real-time incident response dashboards across major SIEM platforms (Splunk, Elastic, Grafana). It provides SOC analysts and leadership with unified situational awareness by tracking affected systems, containment status, Indicators of Compromise (IOC) spread, and the entire incident response timeline, crucial for coordination and post-incident reporting.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This guide details the deployment and configuration of MISP (Malware Information Sharing Platform) using Docker. It demonstrates how to aggregate, correlate, and distribute threat intelligence from diverse sources like abuse.ch and AlienVault OTX. Learn automated feed synchronization, STIX/TAXII integration, and connecting the platform to SIEM and SOAR tools like Splunk and Elasticsearch for centralized IOC management.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This skill details methods and SIEM rules to detect API enumeration attacks, including BOLA and IDOR. It identifies patterns such as sequential ID iteration, parameter tampering, and mixed authorization failure responses (401/403). Use this guide for threat hunting, security incident investigation, and hardening API access control monitoring.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

This skill details the detection of Pass-the-Ticket (PtT) attacks, a critical credential theft technique. It instructs users on analyzing Windows Security Event IDs (4768, 4769, 4771) within SIEM platforms like Splunk or Elastic. Use cases include investigating security incidents, building advanced threat hunting queries, and validating SOC monitoring coverage for lateral movement attacks.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.