Skill UI

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

This skill establishes normal network communication patterns by analyzing historical NetFlow/IPFIX data. Utilizing Python pandas, it computes hourly/daily volume distributions, per-host statistics, and top-talker profiles. Anomalies are detected using sophisticated statistical methods like z-score and IQR, allowing SOC analysts to quickly identify deviations such as data exfiltration spikes, persistent beaconing, or unusual port usage.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

A comprehensive automation toolkit for Mixpanel product analytics, accessible via Rube MCP. Automate key data tasks including event aggregation, detailed segmentation, conversion funnel analysis, user profile management, cohort tracking, and running custom JQL queries. Ideal for data analysts and product managers needing to deeply analyze user behavior patterns.

Guides Power BI visualization and UX decisions—capturing business context, selecting optimal charts, specifying layouts, color, typography, and interaction patterns to create accessible, insight-driven dashboards across audiences.

This skill guides users on how to search for physical monuments, memorials, or landmarks by linking them to their originating historical events. The core technique involves treating the historical event (e.g., a battle, a protest, a significant date) as the primary search anchor, and then locating the associated memorial or structure. It provides structured query templates and anti-patterns to ensure accurate, context-aware geographical and historical information retrieval.

This guide provides production-ready patterns for integrating with Bright Data proxy services. It covers critical aspects like setting up a proxy client, implementing robust retry logic for transient errors (e.g., 502, 503), managing sticky sessions for consistent IPs, and parsing complex HTML responses. Essential for building reliable, high-scale web scrapers using TypeScript and Python.

This workflow automates the extraction of key insights from meeting recordings using Fathom transcripts and summaries. It builds a robust pipeline to identify action items, sync tasks to project management tools, and analyze overall meeting patterns, streamlining post-meeting follow-up and record-keeping.