Skill UI

This comprehensive checklist guides the deployment of Databricks data pipelines and jobs to a production environment. It covers critical stages including pre-deployment security hardening (Service Principals, Unity Catalog), validating infrastructure (cluster types, autoscaling), ensuring code quality (unit/integration tests, Delta Lake best practices), executing controlled deployment, and performing post-deployment health checks and monitoring setup. Ideal for CI/CD pipelines and go-live procedures.

A comprehensive guide to implementing best practices for security within Databricks. Learn how to manage secrets using scoped storage, enforce the principle of least privilege via Unity Catalog grants, audit API tokens, and apply advanced data protection techniques like column-level masking and row-level security for enhanced data governance and compliance.

Enables Claude to apply anomaly-detection-system workflows for spotting outliers, fraud, or unusual patterns across datasets, selecting tailored algorithms like Isolation Forest and summarizing deviations for any data monitoring or security use case.

Hindsight is an open-source tool designed for digital forensics, parsing artifacts from various Chromium-based browsers (Chrome, Edge, Brave, etc.). It extracts and correlates all web activity data, including browsing history, cookies, cached content, downloads, and saved credentials, into a unified timeline. This tool is essential for incident response, insider threat investigations, and reconstructing user web activity in security and legal contexts.

This tool detects abnormal access patterns across major cloud storage services (AWS S3, GCS, Azure Blob Storage). By analyzing audit logs like CloudTrail, it uses statistical baselines and time-series anomaly detection to identify suspicious activities such as after-hours bulk downloads, access from new IPs, or unusual API call spikes. It is crucial for investigating potential data exfiltration incidents or building robust cloud security detection rules.

Perform comprehensive digital forensic analysis on raw (dd), E01, or AFF disk images using industry-standard tools like Autopsy and The Sleuth Kit. This process allows investigators to recover deleted files, examine file system metadata, search for specific keywords, and build detailed investigation timelines. It is essential for generating structured reports from digital evidence in legal and cybersecurity investigations.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

A comprehensive toolset for digital forensics investigators, enabling the parsing of proprietary Microsoft Outlook PST and OST files. It extracts critical evidence including full message content, detailed email headers (for message routing/tracing), attachments, and deleted items from the Recoverable Items folder. Essential for e-discovery, legal investigations, and security incident response to reconstruct communication patterns and analyze message metadata.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

This skill provides comprehensive tracking and visualization for Security Operations Center (SOC) performance. It calculates critical metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and alert quality ratios using SIEM data. Ideal for SOC leadership, compliance auditing, and continuous process improvement initiatives needing quantifiable security posture reporting.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.