Skill UI

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

This skill implements User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch. It goes beyond static rules to build behavioral baselines (e.g., login times, data volume) for users and entities. By calculating anomaly scores and performing peer group analysis, it detects suspicious activities such as data exfiltration, privilege abuse, and unauthorized access, allowing organizations to proactively identify high-risk insider threats.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.

This skill performs deep forensic analysis on SQLite databases, going far beyond simple SQL queries. It is used in digital forensics and incident response to recover deleted records from freelist pages, analyze Write-Ahead Logs (WAL), and examine internal B-tree structures. It is essential for extracting critical evidence from mobile, browser, and application data sources.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.

This is an advanced, structured workflow designed to conduct deep, multi-source investigations. It synthesizes current public evidence with user-provided context to generate highly structured reports. The workflow explicitly differentiates between verifiable facts, user-supplied evidence, logical inferences, and actionable recommendations, making it ideal for complex comparative analysis or continuous monitoring tasks.