Skill UI

This skill provides a comprehensive method for querying advanced threat intelligence using ATT&CK data. It maps the Tactics, Techniques, and Procedures (TTPs) of specific APT groups into MITRE ATT&CK Navigator layers. Users can build multi-layer heatmaps to identify detection gaps, compare threat coverage, and create structured threat-intel reports for defense engineering.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

This skill provides a systematic method to map observed Indicators of Compromise (IOCs) and threat actor TTPs to the global MITRE ATT&CK framework. It guides users in building technique coverage heatmaps using the ATT&CK Navigator, identifying critical detection gaps, and generating actionable threat intelligence reports across Enterprise, Mobile, and ICS domains. Ideal for SOC analysts, threat hunters, and security researchers seeking structured threat analysis.

A comprehensive skill for building detailed threat actor profiles. It systematically collects and correlates intelligence from diverse open-source sources, including vendor reports, dark web forums, social media, and code repositories. The resulting structured dossiers map adversary motivations, capabilities, infrastructure, and Tactics, Techniques, and Procedures (TTPs), enabling robust attribution and defensive planning.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

A comprehensive guide and implementation template for building robust data ingestion pipelines into ClickHouse. Supports multiple sources including HTTP webhooks (with batching), Kafka streams, S3, and direct SQL inserts. Demonstrates best practices for data handling, such as deduplication using ReplacingMergeTree and monitoring query logs, ensuring reliable, scalable data analytics.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

Velociraptor is a powerful open-source platform for endpoint visibility and digital forensics. It allows users to deploy agents across thousands of endpoints and execute sophisticated VQL (Velociraptor Query Language) queries. This enables large-scale, on-demand forensic artifact collection, TTP hunting, and continuous monitoring during incident response, even on air-gapped or unmanaged systems.

This skill serves as a deterministic internal downloader for image URLs extracted from comprehensive web search results. It receives normalized media slots and search output via stdin, utilizing Python HTTP APIs to download direct image links. The process includes validating MIME types and saving files accurately into the configured local project directory, ensuring reliable asset retrieval without relying on sandboxed shell tools.

This skill scans a specified local directory, extracts essential metadata from the files, and builds a comprehensive, searchable index. It then securely uploads this generated index to a configured remote search service via HTTP, making local files discoverable across remote platforms.

This skill queries the NCATS Translator ARAX API for biomedical knowledge-graph relationships. It supports one-hop and two-hop lookups with Biolink constraints, entity normalization, and provider federation. Users can inspect provenance and edge bindings. It is designed for public research queries only, requiring Python 3.10+ and HTTPS access. Do not use for clinical guidance or sensitive data.