Skill UI

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.

This skill analyzes local Q&A session JSONL files to produce a complete, auditable weekly report in Markdown format. It supports generating routine weekly summaries, comparing performance across consecutive time windows, and identifying key trends and risks. The output is a single, self-contained Markdown file designed to provide sufficient aggregates and structure for downstream documentation rendering (e.g., Feishu or whiteboards), without needing external data sources or APIs.