Skill UI

This comprehensive workflow guides developers through implementing full-stack product analytics using PostHog. It covers key areas including defining event taxonomies, capturing user actions (client-side), identifying and updating user properties, and performing B2B group analytics. It also demonstrates server-side event tracking using posthog-node, ensuring a complete, accurate, and traceable view of user behavior and product usage across web, mobile, and API sources.

This skill guides you through integrating PostHog's Customer Data Platform (CDP) features. It covers setting up webhooks to trigger real-time actions (e.g., syncing to CRM, sending notifications) when specific user events occur. Furthermore, it demonstrates how to query event data using the Events API and perform complex funnel analysis using HogQL, allowing for deep, custom insights into user behavior.

SimPy is a powerful, process-based discrete-event simulation framework written in Python. It is designed for modeling complex systems where entities interact with shared resources and time-based events occur, such as manufacturing lines, service queues, network traffic, or logistics networks. Use this skill to analyze resource contention, simulate process optimization, conduct capacity planning, and model dynamic system behaviors.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

This system deploys advanced AI, NLP, and behavioral analytics to detect sophisticated Business Email Compromise (BEC) attacks. Unlike traditional filters that rely on malicious links, this solution analyzes writing style, tone, grammatical patterns, and contextual anomalies to identify pure social engineering impersonation, providing a robust defense layer against advanced phishing and fraud.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This skill implements User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch. It goes beyond static rules to build behavioral baselines (e.g., login times, data volume) for users and entities. By calculating anomaly scores and performing peer group analysis, it detects suspicious activities such as data exfiltration, privilege abuse, and unauthorized access, allowing organizations to proactively identify high-risk insider threats.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

AWS Detective automatically analyzes log data from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to build interactive behavior graphs. This tool enables security analysts to investigate suspicious activity, trace lateral movement across accounts, profile compromised entities (IAM users, EC2 instances), and reconstruct complex attack timelines without manual log parsing. Ideal for triaging GuardDuty findings or investigating suspected AWS compromises.

A comprehensive automation toolkit for Mixpanel product analytics, accessible via Rube MCP. Automate key data tasks including event aggregation, detailed segmentation, conversion funnel analysis, user profile management, cohort tracking, and running custom JQL queries. Ideal for data analysts and product managers needing to deeply analyze user behavior patterns.