Skill UI

Detects abnormal access patterns across major cloud storage platforms, including AWS S3, GCS, and Azure Blob Storage. By analyzing cloud audit logs (CloudTrail, etc.), this tool identifies critical security threats such as after-hours bulk data downloads, sudden spikes in API calls (GetObject spikes), access from new geographic IPs, and potential data exfiltration. It utilizes statistical baselines and time-series anomaly detection for proactive threat hunting and security incident investigation.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This skill implements User and Entity Behavior Analytics (UEBA) to detect sophisticated insider threats. It builds behavioral baselines from diverse log sources (authentication, file access, network) using Elasticsearch/OpenSearch. It calculates anomaly scores and performs peer group analysis to identify deviations indicative of data exfiltration, privilege abuse, or unauthorized access patterns.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This skill provides comprehensive commands for creating, managing, versioning, and querying structured datasets within the Arize platform. It covers dataset CRUD operations, appending examples, and exporting data in various formats (JSON, CSV, Parquet) using the `ax` CLI. Ideal for preparing test data, generating evaluation examples, or retrieving golden datasets for LLM development and model testing.

Structured pipeline for credit risk pre-loan modeling that loads and formats raw data, filters abnormal periods, trims high-missing/low-IV/high-PSI/high-correlation features, denoises via Null Importance, and exports an Excel cleaning report for review.

Use this skill to comprehensively verify all constraints related to a candidate cricket player. By cross-referencing structured data from sources like Wikipedia or Cricinfo, you can confirm details such as birth date, debut match specifics (format, opponent, score), career records, and teams played for. It is crucial for establishing factual accuracy, especially when distinguishing between different formats like ODI, T20I, and Test matches.