Skill UI

Guides ransomware incident response from detection through containment, forensic analysis, recovery, and post-incident hardening while covering negotiation, validation of backups, and regulatory notification steps.

Performs forensic analysis on SQLite databases by reading headers, freelist chains, WAL files, and unallocated pages to recover deleted records and extract evidence from browsers, messaging apps, and mobile storage, aiding incident response and security audits.

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

This skill guides the programmatic creation, enrichment, and secure sharing of threat intelligence within a MISP platform. Using the official PyMISP Python library, users can manage Indicators of Compromise (IOCs), apply MITRE ATT&CK tags, configure sharing groups, and export structured data in STIX 2.1 format. It is essential for security assessments, incident response, and automated threat intelligence pipelines.

Use Kismet’s passive RF monitoring to map 802.11 networks, detect rogue access points and weak encryption, and gather client behavior data for comprehensive wireless security assessments and incident response validation.

Develop precise YARA detection rules by extracting unique strings, imports, and byte patterns from PE samples, organizing meta/strings/condition sections, and tuning logic to minimize false positives during threat hunting and incident response.

Provides step-by-step procedures to detect and remediate misconfigured Amazon S3 buckets, including enabling public access blocks, auditing policies and ACLs, enforcing encryption, and automating fixes with AWS Config and Lambda for compliance or incident response scenarios.

Builds a structured ransomware incident response playbook aligned with CISA StopRansomware guidance and NIST CSF, covering preparation, detection, containment, eradication, recovery, and post-incident chores for readiness assessments and compliance documentation.

A structured methodology for coordinating multiple, simultaneous investigation threads to determine the root cause of complex system failures, performance regressions, or integration bugs. This skill decomposes a large problem into independent tracks (e.g., database, application code, infrastructure), assigns ownership, and manages structured sync points (Continue/Pivot/Converge) to converge on a solution faster than serial debugging. Essential for high-stakes production incident response.