Skill UI

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

This tool detects abnormal access patterns across major cloud storage services (AWS S3, GCS, Azure Blob Storage). By analyzing audit logs like CloudTrail, it uses statistical baselines and time-series anomaly detection to identify suspicious activities such as after-hours bulk downloads, access from new IPs, or unusual API call spikes. It is crucial for investigating potential data exfiltration incidents or building robust cloud security detection rules.

This comprehensive guide details the implementation of Cloud Data Loss Prevention (DLP) using industry-leading tools such as Amazon Macie, Google Cloud DLP, and Azure Information Protection. It provides structured workflows for discovering, classifying, de-identifying, and protecting sensitive data (PII, PHI, financial data) across cloud storage, databases, and data pipelines. Essential for achieving compliance with global regulations (GDPR, HIPAA, PCI DSS) and integrating robust data governance into CI/CD processes.

A comprehensive guide for executing core Snowflake data loading workflows. This covers setting up stages (S3, GCS, Azure), defining file formats (CSV, JSON, Parquet), and using COPY INTO for bulk loading. It also details advanced continuous ingestion using Snowpipe, enabling real-time data synchronization from cloud storage into Snowflake tables.

Generates weekly telemetry reports and customer adoption reports for Azure Backup MCP tools. Runs KQL queries to classify errors into Customer/Azure Service/MCP Tool Bug, identifies customers via cross-cluster joins, compares week-over-week metrics, correlates with merged PRs, and produces an Outlook-compatible HTML report.