Skill UI

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

Build a production-ready, AI-powered data collection agent for any public source (job boards, prices, news, etc.). This agent automatically scrapes data, enriches it using free LLMs (like Gemini Flash), and stores the results in databases such as Notion, Sheets, or Supabase. It runs on a free schedule using GitHub Actions and learns from user feedback, making it ideal for continuous data monitoring and tracking.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This advanced skill systematically verifies the novelty of a proposed academic method or research idea against the latest scientific literature. It performs multi-source searches across databases like arXiv, Google Scholar, and major conference proceedings (ICML, NeurIPS). Using a multi-step process, it extracts core claims, searches multiple sources, performs cross-model verification via LLM, and outputs a structured Novelty Report, detailing overlap, prior work, and overall recommendation.

This skill implements a multi-factor scoring model to assess the criticality of IT assets. By weighting factors such as business function impact, data sensitivity, regulatory scope, and network exposure, it assigns a risk tier. This tier is then used to dynamically adjust the Service Level Agreements (SLAs) for vulnerability remediation, ensuring that organizations prioritize patching efforts on their most critical 'crown jewel' systems first.

This workflow bridges the gap between an abstract experiment plan and concrete, executable code. It reads structured experiment roadmaps (e.g., EXPERIMENT_PLAN.md), automatically generates or modifies necessary code scripts, handles prerequisite setup (like cloning base repositories), deploys the experiments to compute resources (GPU), and meticulously collects initial results. It includes optional steps for cross-model code review, ensuring robustness and correctness before execution. Ideal for moving from research hypotheses to measurable, running results.

Provides REST API access to PubMed for building advanced Boolean/MeSH queries, filtering by publication details, and programmatically fetching citations through E-utilities, making it ideal for systematic reviews and automated literature workflows.

This skill provides comprehensive management for annotation schemas (configs) and human review workflows (queues) within the Arize platform. It supports defining categorical, continuous, and freeform label types. Users can programmatically apply these annotations to project spans and datasets using the Python SDK, facilitating structured human feedback loops and improving model monitoring.