Skill UI

This tool parses API Gateway access logs from various providers (AWS, Kong, Nginx). It performs statistical analysis using pandas to detect critical security threats such as Broken Object Level Authorization (BOLA/IDOR), credential stuffing, rate limit bypass attempts, and injection vulnerabilities. Ideal for SOC analysts or security engineers investigating API abuse and building advanced threat detection rules.

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

This tool detects abnormal access patterns across major cloud storage services (AWS S3, GCS, Azure Blob Storage). By analyzing audit logs like CloudTrail, it uses statistical baselines and time-series anomaly detection to identify suspicious activities such as after-hours bulk downloads, access from new IPs, or unusual API call spikes. It is crucial for investigating potential data exfiltration incidents or building robust cloud security detection rules.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

A comprehensive guide and toolkit for extracting, parsing, and analyzing Windows Event Logs (EVTX). This method utilizes industry-leading tools like Chainsaw and Hayabusa, along with Sigma rules, to perform deep digital forensics. It is specifically designed to detect critical security indicators such as lateral movement, persistence mechanisms, privilege escalation, and unauthorized access attempts on Windows systems.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This skill guides security teams on systematically tuning SIEM detection rules in platforms like Splunk and Elastic. It focuses on reducing alert fatigue and false positives by analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and measuring detection efficacy using metrics like precision and recall. This is crucial for maturing a Security Operations Center (SOC).

This skill provides a comprehensive framework for detecting NTLM relay attacks (T1557.001). It achieves this by correlating Windows Security Event 4624 (LogonType 3) to identify IP-to-hostname mismatches, detecting artifacts from Responder/LLMNR poisoning, and auditing SMB/LDAP protocol signing weaknesses. Use it for proactive threat hunting in Active Directory environments, investigating authentication anomalies, or building SIEM correlation rules.