Skill UI

This skill analyzes Windows Security Event Logs (EVTX) to detect RDP brute force attacks. It parses failed logon events (ID 4625) and correlates them with successful logons (ID 4624), performing source IP frequency analysis to identify attack patterns, username spraying, and potential account compromises. This is critical for SOC analysts and threat hunters investigating lateral movement or credential stuffing attempts.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This skill connects to the DeepEar Lite platform to fetch real-time, high-frequency financial signals. It retrieves crucial data points including signal titles, sentiment summaries, confidence scores, and detailed reasoning. Use this when you require immediate, actionable insights into volatile market trends, stock performance factors, or comprehensive financial analysis.