Skill UI

Automate Splunk ES threat intelligence enrichment by ingesting external feeds, normalizing IOCs into KV Store collections, and running lookup-based correlation searches so SOC analysts get immediate context from multiple sources.

Design and execute comprehensive social engineering penetration tests, covering phishing, vishing, smishing, and physical pretexting to measure human security resilience and reveal training gaps.

Conduct authorized vishing pretext calls to assess employee susceptibility, validate verification workflows, and benchmark security awareness during red team engagements and security audits.

Guides red teams through OSINT-driven spearphishing simulation campaigns, covering pretext development, payload crafting, email infrastructure setup, execution, and post-campaign analysis for authorized assessments.

Correlates IBM QRadar SIEM events using AQL queries, custom rules, building blocks, and reference sets to detect multi-stage attacks, tune offenses, and enrich context across network, endpoint, and application logs.

Uses Context7 MCP to fetch up-to-date library or framework documentation for setup questions, API references, and code snippets, ensuring responses rely on live official sources rather than outdated training data.

Runs authorized phishing simulation campaigns that design realistic pretexts, send targeted GoPhish emails, and track opens, clicks, and credential reports to measure organizational security awareness and resilience.

Detects command-and-control beaconing in network telemetry via frequency/jitter analysis, reputation checks, and endpoint context so hunters can spotlight compromised hosts and guide response workflows.

Implements BeyondCorp zero trust access by weaving Identity-Aware Proxy, Access Context Manager, and Chrome Enterprise device verification so teams can retire VPNs and enforce granular identity/device policies before granting app access across Google Cloud workloads.

This guide details the implementation of Delinea Secret Server for robust Privileged Access Management (PAM). It covers infrastructure deployment (IIS, SQL Server), configuring secret templates, automating the onboarding of credentials, and establishing centralized vaulting for sensitive accounts. It is essential for organizations needing to meet compliance mandates (SOX, PCI-DSS) by eliminating plaintext credentials and automating password rotation.

Deploy and configure the Dragos Platform to monitor OT networks, tapping into 600+ industrial protocols, threat-intelligence-backed detection, asset discovery, vulnerability context, and SIEM integration for SOC teams.

Guide for deploying Zscaler Private Access (ZPA) to replace VPNs with identity-aware, context-driven access to private apps, covering connectors, segmentation, policies, posture checks, and client rollout.