Skill UI

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This guide details how to detect WMI event subscription persistence, a common attacker technique (T1546.003). It focuses on analyzing suspicious Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and Bindings. Essential for incident response and threat hunting in Windows environments.

A comprehensive workflow for extracting, parsing, and analyzing Windows Event Logs (EVTX). It guides security professionals in using advanced tools like Chainsaw and Hayabusa, combined with Sigma rules, to detect critical security incidents such as lateral movement, privilege escalation, and persistence mechanisms during incident response and digital forensic investigations.

This skill guides the creation of high-quality, finished cyber threat intelligence reports. It tails content for specific audiences—from C-suite executives (strategic risk) to SOC analysts (tactical IOCs). Use it when synthesizing raw data into actionable intelligence products, generating threat briefings, or conducting post-incident assessments, ensuring adherence to industry standards like TLP and NIST.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This sophisticated workflow guides users from a broad research concept or initial topic to a fully validated, actionable, and pilot-tested research idea. It orchestrates a multi-stage pipeline, including literature surveys, novelty checks, detailed idea generation, critical review, and the creation of a refined experimental plan, ensuring the output is a robust proposal ready for implementation.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

This comprehensive skill guides the user through monitoring various running experiments across different platforms (SSH, Vast.ai, Modal). It provides structured steps to check running processes, collect logs, extract structured JSON results, and pull detailed metrics from Weights & Biases (W&B). Finally, it summarizes findings, compares against baselines, and suggests next steps.

This toolset guides users through advanced digital forensic techniques using tools like Foremost and Scalpel. It demonstrates how to perform file carving—recovering specific file types (images, documents, etc.) from raw disk images or unallocated space—by analyzing file headers and footers (magic bytes). This is critical for evidence extraction when traditional file system metadata is unavailable or corrupted.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.