Skill UI

This skill facilitates the creation of real-time incident response dashboards across major SIEM platforms (Splunk, Elastic, Grafana). It provides SOC analysts and leadership with unified situational awareness by tracking affected systems, containment status, Indicators of Compromise (IOC) spread, and the entire incident response timeline, crucial for coordination and post-incident reporting.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This guide details how to build automated threat intelligence enrichment pipelines within Splunk Enterprise Security. By leveraging the Threat Intelligence Framework, users can ingest, normalize, and correlate Indicators of Compromise (IOCs) from diverse external sources (such as TAXII, CSV, and custom APIs). The process uses KV Store collections and lookup searches to enrich raw security events with critical threat context, significantly reducing triage time for SOC teams.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This system manages vulnerabilities that cannot be remediated within Service Level Agreement (SLA) timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining formal risk acceptance approvals, and automatically managing expiration. It helps organizations maintain visibility into accepted risks to comply with major frameworks like PCI DSS, SOC 2, and NIST CSF.

This workflow guides SOC teams in establishing a comprehensive, structured process for vulnerability management. It utilizes major scanning tools (Nessus, Qualys, OpenVAS) to discover, prioritize, and track remediation of security weaknesses across the infrastructure. It integrates threat intelligence (CISA KEV) and asset criticality into risk scoring, ensuring resources are focused on the most critical threats.

This comprehensive skill guides users through designing and executing advanced social engineering penetration tests. It covers simulating real-world attacks, including phishing (email), vishing (voice), smishing (SMS), and physical pretexting. The goal is to measure an organization's human security resilience, identify training gaps, and test security controls across multiple vectors using tools like GoPhish and SET.

Guides SOC teams through validating alerts, isolating networks and endpoints, preserving evidence, and disabling compromised accounts to rapidly contain an active breach while minimizing business impact.

This skill uses the Python azure-mgmt-storage SDK to perform comprehensive security audits on Azure Blob and ADLS storage accounts. It detects critical misconfigurations, including public access exposure, weak or long-lived SAS tokens, lack of encryption at rest, failure to enforce HTTPS, and outdated TLS versions. The output is a detailed, risk-scored report with remediation recommendations, essential for SOC analysts and security posture management.

This skill provides comprehensive guidelines for detecting Business Email Compromise (BEC), a sophisticated fraud scheme. It covers detection techniques using email gateway rules, behavioral analytics, and robust financial process controls. Learn to identify red flags like unusual payment requests, domain mismatches, and patterns of social engineering to protect against financial loss.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.