Skill UI

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.

A powerful toolset for automating core PostHog product analytics tasks via Rube MCP. It enables developers and analysts to capture user events, list and filter event data, manage feature flags (creation, retrieval, listing), and inspect user profiles. Ideal for integrating advanced product tracking and A/B testing workflows directly into development pipelines.

This skill guides users on how to search for physical monuments, memorials, or landmarks by linking them to their originating historical events. The core technique involves treating the historical event (e.g., a battle, a protest, a significant date) as the primary search anchor, and then locating the associated memorial or structure. It provides structured query templates and anti-patterns to ensure accurate, context-aware geographical and historical information retrieval.

This technique guides the identification of musicians by prioritizing unique personal life events over discography details (albums or songs). It instructs users to use highly distinctive biographical information—such as career turning points, specific personal relationships, or unusual life incidents—as the primary search anchor. This method significantly improves search accuracy when typical musical clues are insufficient.

The ETE Toolkit is a powerful Python library designed for analyzing, manipulating, comparing, and visualizing phylogenetic trees stored in Newick or Nexus formats. It allows users to perform topology edits, calculate phylogenetic distances (e.g., Robinson-Foulds), detect evolutionary events, and query external taxonomic databases like NCBI/GTDB. Note that this tool analyzes existing trees; it is not used for inferring trees from raw sequences.

This skill provides a robust solution for monitoring critical forecast changes within Clari. Since Clari lacks native real-time webhooks for all data, this system implements change detection by polling periodic data exports and comparing current snapshots against historical records. It calculates the percentage change and can trigger immediate alerts via platforms like Slack, ensuring users are always aware of significant shifts in revenue forecasts or sales pipelines.

A comprehensive guide and implementation template for building robust data ingestion pipelines into ClickHouse. Supports multiple sources including HTTP webhooks (with batching), Kafka streams, S3, and direct SQL inserts. Demonstrates best practices for data handling, such as deduplication using ReplacingMergeTree and monitoring query logs, ensuring reliable, scalable data analytics.

This comprehensive guide details the process of implementing a secure and robust system for handling Palantir Foundry webhook events. It covers key steps including API-based webhook registration, mandatory signature verification with replay protection, sophisticated event routing for various object lifecycles (create, update, delete), and ensuring idempotent processing using caching mechanisms like Redis. Use this when external microservices must react reliably and immediately to changes within the Foundry Ontology or data assets.

This skill provides comprehensive intelligence across finance and media. Users can search real-time news, analyze media bias across multiple dimensions, get live stock/crypto data with AI forecasts, price financial options using ML models, and synthesize balanced perspectives on current events. It is ideal for deep research, investment analysis, and media literacy.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.