Skill UI

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

This comprehensive skill guides the user through monitoring various running experiments across different platforms (SSH, Vast.ai, Modal). It provides structured steps to check running processes, collect logs, extract structured JSON results, and pull detailed metrics from Weights & Biases (W&B). Finally, it summarizes findings, compares against baselines, and suggests next steps.

This advanced skill systematically verifies the novelty of a proposed academic method or research idea against the latest scientific literature. It performs multi-source searches across databases like arXiv, Google Scholar, and major conference proceedings (ICML, NeurIPS). Using a multi-step process, it extracts core claims, searches multiple sources, performs cross-model verification via LLM, and outputs a structured Novelty Report, detailing overlap, prior work, and overall recommendation.

This skill automates the generation of high-quality, publication-ready figures and comparison tables from raw experimental data (CSV, JSON, etc.). It supports various plot types, including line plots, bar charts, scatter plots, heatmaps, and box plots, ensuring consistent style (DPI 300, PDF format) suitable for academic submissions. Users provide a figure plan and raw data, and the system generates the necessary code to visualize results.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

This toolset guides users through advanced digital forensic techniques using tools like Foremost and Scalpel. It demonstrates how to perform file carving—recovering specific file types (images, documents, etc.) from raw disk images or unallocated space—by analyzing file headers and footers (magic bytes). This is critical for evidence extraction when traditional file system metadata is unavailable or corrupted.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.

This tool conducts comprehensive, sector-specific threat landscape assessments by analyzing designated threat actor patterns (e.g., APT groups, cybercriminals), common attack vectors, and industry-specific vulnerabilities. It is designed to provide actionable intelligence for risk management, security investment prioritization, and executive reporting across critical sectors like finance, healthcare, and energy.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.