Skill UI

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This tool conducts comprehensive, sector-specific threat landscape assessments by analyzing designated threat actor patterns (e.g., APT groups, cybercriminals), common attack vectors, and industry-specific vulnerabilities. It is designed to provide actionable intelligence for risk management, security investment prioritization, and executive reporting across critical sectors like finance, healthcare, and energy.

This framework manages the ingestion, organization, synchronization, and search of knowledge across multiple storage layers, including local files, persistent memory, vector stores, and Git repositories. It provides a structured approach for ensuring knowledge durability, deduplication, and maintaining a 'single source of truth' across complex development and operational contexts.

This skill provides comprehensive management for annotation schemas (configs) and human review workflows (queues) within the Arize platform. It supports defining categorical, continuous, and freeform label types. Users can programmatically apply these annotations to project spans and datasets using the Python SDK, facilitating structured human feedback loops and improving model monitoring.

A comprehensive automation toolkit for Mixpanel product analytics, accessible via Rube MCP. Automate key data tasks including event aggregation, detailed segmentation, conversion funnel analysis, user profile management, cohort tracking, and running custom JQL queries. Ideal for data analysts and product managers needing to deeply analyze user behavior patterns.

A powerful toolset for automating core PostHog product analytics tasks via Rube MCP. It enables developers and analysts to capture user events, list and filter event data, manage feature flags (creation, retrieval, listing), and inspect user profiles. Ideal for integrating advanced product tracking and A/B testing workflows directly into development pipelines.

This skill provides comprehensive commands to manage the entire AI model evaluation lifecycle using Arize. Users can list, retrieve metadata, and export results from experiments. It is ideal for comparing multiple model runs, benchmarking performance against a dataset, and analyzing model accuracy using structured evaluation workflows (CRUD operations).

This skill provides comprehensive commands for creating, managing, versioning, and querying structured datasets within the Arize platform. It covers dataset CRUD operations, appending examples, and exporting data in various formats (JSON, CSV, Parquet) using the `ax` CLI. Ideal for preparing test data, generating evaluation examples, or retrieving golden datasets for LLM development and model testing.

Automates GA4 reporting and property management via Composio’s Rube MCP, covering account/property discovery, standard/batch/pivot/funnel reports, and key event workflows so analysts can run repeatable queries without manual UI steps.

Orchestrate Segment customer-data actions through Rube MCP and Composio, covering event tracking, user identification, grouping, page views, batch dispatches, alias merges, and source management while always refreshing schema info first.