Skill UI

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill implements User and Entity Behavior Analytics (UEBA) to detect sophisticated insider threats. It builds behavioral baselines from diverse log sources (authentication, file access, network) using Elasticsearch/OpenSearch. It calculates anomaly scores and performs peer group analysis to identify deviations indicative of data exfiltration, privilege abuse, or unauthorized access patterns.

This skill analyzes network logs, including proxy access logs, DNS query logs, and netflow data, to detect unauthorized Software as a Service (SaaS) applications and cloud services (Shadow IT). It classifies domains against known catalogs, measures data exfiltration volumes, calculates risk scores, and generates comprehensive reports for security and compliance teams.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

This skill implements a multi-factor scoring model to assess the criticality of IT assets. By weighting factors such as business function impact, data sensitivity, regulatory scope, and network exposure, it assigns a risk tier. This tier is then used to dynamically adjust the Service Level Agreements (SLAs) for vulnerability remediation, ensuring that organizations prioritize patching efforts on their most critical 'crown jewel' systems first.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.

This comprehensive guide provides a detailed workflow for parsing Windows LNK shortcut files in a digital forensics context. It extracts critical artifacts including target paths, timestamps (creation, access, modification), volume serial numbers, and machine identifiers. It is essential for reconstructing user file access history, tracking accessed files on network shares, and building robust forensic timelines.

An advanced tool for network intelligence that calculates weighted graph scores to map the optimal path to a target. It identifies potential introducers, measures 'bridge value' across connections, and helps determine whether a connection requires a warm introduction or direct outreach on platforms like X and LinkedIn. Ideal for users needing the raw ranking methodology.

Arboreto is a powerful Python library designed for inferring Gene Regulatory Networks (GRNs) from various gene expression datasets, including bulk and single-cell RNA-seq data. It leverages advanced machine learning algorithms like GRNBoost2 and GENIE3. The library supports scalable, distributed computation using Dask, making it ideal for analyzing large-scale, complex transcriptomics datasets to identify critical transcription factor-target gene relationships.

NetworkX is a powerful Python library designed for creating, manipulating, and analyzing complex graph and network structures. It supports core graph algorithms such as finding shortest paths, calculating centrality measures (e.g., PageRank, Betweenness), detecting communities, and generating various synthetic network models. It is indispensable for fields like social network analysis, bioinformatics, and transportation system modeling.