Skill UI

Timesketch is a collaborative, open-source platform for security teams to analyze and reconstruct complex forensic timelines. It ingests and normalizes multi-source security data (logs, artifacts) using methods like Plaso, CSV, and JSONL. Users can visualize event chronology, track attack chains, and utilize advanced built-in analyzers (e.g., Sigma, Chain of Events) for comprehensive incident investigation and documentation.

This skill provides a systematic methodology for building comprehensive threat actor profiles using Open-Source Intelligence (OSINT). It involves gathering, correlating, and analyzing publicly available data from diverse sources (e.g., vendor reports, dark web forums, code repositories). Users can map adversary TTPs to MITRE ATT&CK, assess motivations, and build structured dossiers for proactive defensive strategies and attribution assessments.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill provides a comprehensive framework for detecting data exfiltration attempts that utilize DNS tunneling. It analyzes DNS logs for anomalies such as high Shannon entropy in subdomains, excessive query volume, abnormal query lengths, and misuse of TXT/CNAME records. It is ideal for SOC analysts and security engineers building advanced threat detection rules and performing threat hunting.

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

This skill implements User and Entity Behavior Analytics (UEBA) to detect sophisticated insider threats. It builds behavioral baselines from diverse log sources (authentication, file access, network) using Elasticsearch/OpenSearch. It calculates anomaly scores and performs peer group analysis to identify deviations indicative of data exfiltration, privilege abuse, or unauthorized access patterns.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

This skill provides institutional-depth equity analysis by combining public SEC EDGAR filings and real-time market data. It can generate structured, verdict-style memos, score stocks across four key pillars (Momentum, Stability, Financial Health, Upside), and perform side-by-side comparisons of two tickers, enabling data-driven investment decision support without requiring proprietary terminal access.

ADHX provides a dedicated API to fetch X/Twitter posts as clean, structured JSON. It extracts comprehensive data, including author profiles, engagement metrics (likes, retweets), and full article content for long-form posts. This method is vastly superior to traditional scraping techniques, making it ideal for LLM analysis, summarization, and structured data workflows.

This skill uses advanced AI and LLM capabilities to correlate fragmented Open Source Intelligence (OSINT) data. It ingests findings from diverse sources—including username enumeration, email lookups, social media, domain records, and breach databases—to generate unified, intelligence-grade profiles. It provides link analysis and confidence scoring, transforming raw data into actionable threat intelligence for target profiling.

This skill provides programmatic access to comprehensive global financial market data via the Alpha Vantage API. Users can retrieve time-series data, including historical prices (OHLCV) for equities, options, forex, commodities, and crypto. It also provides access to fundamental metrics (e.g., P/E ratio, market capitalization), economic indicators (e.g., GDP, CPI), and over 40 technical indicators (e.g., RSI, MACD), making it ideal for quantitative analysis and financial modeling.

Plotly is a powerful Python graphing library designed to create highly interactive, publication-quality visualizations. It supports over 40 chart types, including scatter plots, heatmaps, candlestick charts, and geographical maps. Ideal for building sophisticated dashboards, conducting deep exploratory data analysis, and creating rich, web-embeddable presentations with features like zooming, panning, and hover tooltips.