Skill UI

A toolkit for phylogenetic tree manipulation, event detection, NCBI taxonomy integration, and publication-quality visualization, streamlining phylogenomics workflows and gene family analysis.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This tool provides comprehensive analysis of the cybersecurity threat landscape using the Malware Information Sharing Platform (MISP). It allows users to query event statistics, analyze attribute distributions (IPs, domains, hashes), identify top threat actors and malware families, and track temporal trends. It is essential for SOC analysts performing incident response, threat hunting, and building advanced detection rules.

This skill provides a comprehensive framework for detecting Living Off the Land Binaries (LOLBAS) abuse, such as misuse of certutil, regsvr32, and mshta. It leverages process telemetry from Sysmon and Windows Event Logs, combined with advanced Sigma rule-based detection and parent-child process anomaly analysis. Ideal for SOC analysts and threat hunters investigating sophisticated adversaries aiming to evade traditional security controls.

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This skill provides a robust solution for monitoring critical forecast changes within Clari. Since Clari lacks native real-time webhooks for all data, this system implements change detection by polling periodic data exports and comparing current snapshots against historical records. It calculates the percentage change and can trigger immediate alerts via platforms like Slack, ensuring users are always aware of significant shifts in revenue forecasts or sales pipelines.

Analyzes options chain data by separating real calls and puts from lottery-like speculative contracts to produce more reliable put/call sentiment, anomaly detection, and expiry breakdowns for watchlists, sectors, and event-driven names.

This tool performs robust outlier detection on individual session spending. Utilizing Median and Median Absolute Deviation (MAD), it calculates a modified z-score, making it highly resistant to extreme values, unlike mean+sigma methods. It specifically identifies which singular sessions are anomalous, making it crucial for cost monitoring, auditing, and integrating into CI/CD pipelines to prevent unexpected resource overruns.