Skill UI

This specialized skill is designed for Digital Forensics and Incident Response (DFIR) scenarios. It correlates evidence from multiple disparate sources—including EVTX, PCAP, registry, memory, and filesystem artifacts—to build a comprehensive, ordered, and replayable forensic timeline. Use it when the goal is to map the full sequence of attacker actions, establishing initial access, lateral movement, and persistence chains based on cross-source evidence correlation.

This skill performs deep 'git archaeology' by cross-referencing commit history, changelogs, and initial summaries. It extracts verified metrics like commit velocity, contributor rankings, and release timelines, generating multiple detailed reports. Use this when building a REX talk and needing factual, data-backed evidence from a source git repository.

A rigorous framework for making evidence-based estimates and forecasts when precise data is unavailable. It guides users to anchor predictions on base rates, articulate uncertainty using confidence intervals, and systematically update beliefs using likelihood ratios (prior to posterior) as new evidence arrives. Ideal for risk sizing, project timelines, and strategic decision-making.