Skill UI

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

This guide provides advanced detection methods and threat hunting queries (KQL/SPL) to identify abuse of Azure service principals. It covers techniques such as privilege escalation, credential compromise, unauthorized role assignment, and enumeration, essential for SOC analysts and security teams monitoring Microsoft Entra ID.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.