Skill UI

AWS Detective automatically analyzes log data from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to build interactive behavior graphs. This tool enables security analysts to investigate suspicious activity, trace lateral movement across accounts, profile compromised entities (IAM users, EC2 instances), and reconstruct complex attack timelines without manual log parsing. Ideal for triaging GuardDuty findings or investigating suspected AWS compromises.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

A comprehensive guide for threat hunters focusing on detecting stolen session cookies and OAuth/PRT token replay (T1550.001). This skill teaches correlation techniques across Microsoft Entra ID SigninLogs and Okta System Logs, enabling the detection of impossible travel, refresh-token reuse, and anomalous lateral movement within federated SaaS environments. Essential for post-phishing or post-compromise investigations.

A specialized skill for conducting authorized Open Source Intelligence (OSINT) and cyber threat intelligence gathering. It enriches Indicators of Compromise (IOCs), tracks malicious campaigns, and analyzes impersonation or scamming narratives from public platforms like X/Twitter. The process mandates rigorous evidence corroboration, source preservation, and structured handoff to digital forensics or threat-hunting pipelines.