Skill UI

A toolkit for phylogenetic tree manipulation, event detection, NCBI taxonomy integration, and publication-quality visualization, streamlining phylogenomics workflows and gene family analysis.

FlowIO reads and writes Flow Cytometry Standard (FCS) files, exposing metadata, channels, and NumPy event arrays while allowing CSV/DataFrame conversion, making it ideal for cytometry pipelines and backend preprocessing services.

Toolkit for Python-based survival and time-to-event modeling with scikit-survival, supporting Cox models, ensemble learners, SVMs, and evaluation metrics for censored data.

SimPy is a powerful, process-based discrete-event simulation framework written in Python. It is designed for modeling complex systems where entities interact with shared resources and time-based events occur, such as manufacturing lines, service queues, network traffic, or logistics networks. Use this skill to analyze resource contention, simulate process optimization, conduct capacity planning, and model dynamic system behaviors.

This skill provides deep analytical insights into aggregated family health data. It assesses genetic predisposition, identifies patterns of familial diseases, calculates weighted risk scores based on historical data, and generates personalized, actionable prevention recommendations. Ideal for generating comprehensive family health reports and trend analysis.

A comprehensive guide to product analytics, covering essential concepts like event tracking (PostHog, Mixpanel), funnels, cohort analysis, retention metrics, North Star Metrics, and OKR setting. Use this skill to define data-driven product strategies, optimize user journeys, and build robust performance dashboards.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This tool provides comprehensive analysis of the cybersecurity threat landscape using the Malware Information Sharing Platform (MISP). It allows users to query event statistics, analyze attribute distributions (IPs, domains, hashes), identify top threat actors and malware families, and track temporal trends. It is essential for SOC analysts performing incident response, threat hunting, and building advanced detection rules.

Timesketch is a collaborative, open-source platform for security teams to analyze and reconstruct complex forensic timelines. It ingests and normalizes multi-source security data (logs, artifacts) using methods like Plaso, CSV, and JSONL. Users can visualize event chronology, track attack chains, and utilize advanced built-in analyzers (e.g., Sigma, Chain of Events) for comprehensive incident investigation and documentation.

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This skill provides a comprehensive framework for detecting Living Off the Land Binaries (LOLBAS) abuse, such as misuse of certutil, regsvr32, and mshta. It leverages process telemetry from Sysmon and Windows Event Logs, combined with advanced Sigma rule-based detection and parent-child process anomaly analysis. Ideal for SOC analysts and threat hunters investigating sophisticated adversaries aiming to evade traditional security controls.

This skill analyzes Windows Security Event Logs (EVTX) to detect RDP brute force attacks. It parses failed logon events (ID 4625) and correlates them with successful logons (ID 4624), performing source IP frequency analysis to identify attack patterns, username spraying, and potential account compromises. This is critical for SOC analysts and threat hunters investigating lateral movement or credential stuffing attempts.