Skill UI

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

This guide details a comprehensive workflow for digital forensic investigations focusing on Amcache.hve registry hive. It teaches how to use AmcacheParser to extract evidence of program execution, application installation, and driver loading, including correlating SHA-1 hashes with threat intelligence and reconstructing timelines. This is crucial for DFIR work to identify deleted executables and malicious activity.

This skill provides comprehensive tracking and visualization for Security Operations Center (SOC) performance. It calculates critical metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and alert quality ratios using SIEM data. Ideal for SOC leadership, compliance auditing, and continuous process improvement initiatives needing quantifiable security posture reporting.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.

This skill guides the creation of high-quality, finished cyber threat intelligence reports. It tails content for specific audiences—from C-suite executives (strategic risk) to SOC analysts (tactical IOCs). Use it when synthesizing raw data into actionable intelligence products, generating threat briefings, or conducting post-incident assessments, ensuring adherence to industry standards like TLP and NIST.

Generate publication-quality figures and tables from experiment data. Supports line plots, bar charts, scatter plots, heatmaps, box/violin plots, and multi-panel figures for academic papers. Uses consistent matplotlib styling, high-resolution PDF/PNG output, and can optionally review figures via Codex MCP.

Implements a robust, multi-factor model to calculate the criticality score of IT assets. The scoring incorporates data sensitivity, business function dependency, regulatory scope, and network exposure, moving beyond simple CVSS scores. The resulting 1-5 criticality tier directly modifies vulnerability remediation Service Level Agreements (SLAs), ensuring security resources are focused on the organization's most valuable and risky systems.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This comprehensive tool manages the complete lifecycle of ML experiments, providing robust deployment capabilities across diverse environments. It supports running training jobs on local GPUs, dedicated remote servers, Vast.ai, and serverless platforms like Modal. The workflow handles environment detection, code synchronization (rsync/git), dependency pinning, and integrates advanced logging tools (e.g., W&B), ensuring reliable, scalable, and reproducible ML training runs.

This guide details the process of parsing Windows LNK shortcut files to extract crucial forensic artifacts. It gathers information such as target paths, MAC timestamps, volume serial numbers, and machine identifiers. This technique is invaluable in digital forensics, helping investigators reconstruct user activity timelines, track accessed files on removable media, or build comprehensive evidence from compromised systems.