Skill UI

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

Provides a detailed, multi-platform workflow to monitor long-running computational experiments. It checks the status of jobs across various environments (SSH, vast.ai, Modal), collects screen logs, fetches structured JSON results, and pulls detailed training metrics (loss curves, accuracy) from Weights & Biases (W&B). Essential for MLOps and automated result review.

This advanced skill systematically verifies the novelty of a proposed research method or technical idea against the global body of academic literature. It guides the user to extract core technical claims, performs multi-source searches across major academic databases (e.g., arXiv, Google Scholar, top conferences), and utilizes high-level LLM reasoning to generate a detailed, structured novelty assessment report. Ideal for researchers seeking to validate the unique contribution of their work.

Automates the generation of high-quality, publication-ready figures and comparison tables from raw experimental data (JSON, CSV). This skill is essential for academic writing workflows, handling various plot types including line graphs, bar charts, scatter plots, and heatmaps, ensuring consistency with professional style guides like LaTeX and specific DPI requirements.

This skill implements a multi-factor scoring model to assess the criticality of IT assets. By weighting factors such as business function impact, data sensitivity, regulatory scope, and network exposure, it assigns a risk tier. This tier is then used to dynamically adjust the Service Level Agreements (SLAs) for vulnerability remediation, ensuring that organizations prioritize patching efforts on their most critical 'crown jewel' systems first.

This toolset guides users through advanced digital forensic techniques using tools like Foremost and Scalpel. It demonstrates how to perform file carving—recovering specific file types (images, documents, etc.) from raw disk images or unallocated space—by analyzing file headers and footers (magic bytes). This is critical for evidence extraction when traditional file system metadata is unavailable or corrupted.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This tool conducts comprehensive, sector-specific threat landscape assessments by analyzing designated threat actor patterns (e.g., APT groups, cybercriminals), common attack vectors, and industry-specific vulnerabilities. It is designed to provide actionable intelligence for risk management, security investment prioritization, and executive reporting across critical sectors like finance, healthcare, and energy.