Skill UI

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

A comprehensive toolset for digital forensics investigators, enabling the parsing of proprietary Microsoft Outlook PST and OST files. It extracts critical evidence including full message content, detailed email headers (for message routing/tracing), attachments, and deleted items from the Recoverable Items folder. Essential for e-discovery, legal investigations, and security incident response to reconstruct communication patterns and analyze message metadata.

This skill provides a systematic method to map observed Indicators of Compromise (IOCs) and threat actor TTPs to the global MITRE ATT&CK framework. It guides users in building technique coverage heatmaps using the ATT&CK Navigator, identifying critical detection gaps, and generating actionable threat intelligence reports across Enterprise, Mobile, and ICS domains. Ideal for SOC analysts, threat hunters, and security researchers seeking structured threat analysis.

This tool queries a MISP (Malware Information Sharing Platform) instance via PyMISP to compute detailed event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends. It generates comprehensive threat landscape reports, visualizing temporal trends. Use it when investigating security incidents, summarizing top threat actors or malware families, or producing a formal Cyber Threat Intelligence (CTI) report.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

This skill provides comprehensive tracking and visualization for Security Operations Center (SOC) performance. It calculates critical metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and alert quality ratios using SIEM data. Ideal for SOC leadership, compliance auditing, and continuous process improvement initiatives needing quantifiable security posture reporting.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

A comprehensive guide to deploying and configuring osquery across diverse endpoints (Windows, macOS, Linux). This tool allows security teams to gather deep, SQL-based insights into endpoint state, including running processes, network connections, system configuration, and installed software. It is essential for threat hunting, compliance auditing, and building centralized fleet visibility.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.