Skill UI

Analyzes oral health records to detect trends, assess caries and periodontal risks, and generate personalized care advice. Supports linked analysis with nutrition, chronic disease, medication, and eye health data for comprehensive oral care insights.

Umap provides uniform manifold approximation for dimension reduction and visualization, helping data scientists explore high-dimensional embeddings through interpretable 2D/3D layouts.

Query the PrimeKG precision medicine knowledge graph to explore genes, drugs, diseases, phenotypes, and their relationships, supporting drug discovery, repurposing, and phenotype analysis through programmatic scripts.

This tool parses API Gateway access logs from various providers (AWS, Kong, Nginx). It performs statistical analysis using pandas to detect critical security threats such as Broken Object Level Authorization (BOLA/IDOR), credential stuffing, rate limit bypass attempts, and injection vulnerabilities. Ideal for SOC analysts or security engineers investigating API abuse and building advanced threat detection rules.

This skill provides a comprehensive method for querying advanced threat intelligence using ATT&CK data. It maps the Tactics, Techniques, and Procedures (TTPs) of specific APT groups into MITRE ATT&CK Navigator layers. Users can build multi-layer heatmaps to identify detection gaps, compare threat coverage, and create structured threat-intel reports for defense engineering.

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

Hindsight is an open-source tool designed for digital forensics, parsing artifacts from various Chromium-based browsers (Chrome, Edge, Brave, etc.). It extracts and correlates all web activity data, including browsing history, cookies, cached content, downloads, and saved credentials, into a unified timeline. This tool is essential for incident response, insider threat investigations, and reconstructing user web activity in security and legal contexts.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This skill provides a systematic method to map observed Indicators of Compromise (IOCs) and threat actor TTPs to the global MITRE ATT&CK framework. It guides users in building technique coverage heatmaps using the ATT&CK Navigator, identifying critical detection gaps, and generating actionable threat intelligence reports across Enterprise, Mobile, and ICS domains. Ideal for SOC analysts, threat hunters, and security researchers seeking structured threat analysis.

This tool queries a MISP (Malware Information Sharing Platform) instance via PyMISP to compute detailed event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends. It generates comprehensive threat landscape reports, visualizing temporal trends. Use it when investigating security incidents, summarizing top threat actors or malware families, or producing a formal Cyber Threat Intelligence (CTI) report.