Skill UI

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

This skill provides comprehensive tracking and visualization for Security Operations Center (SOC) performance. It calculates critical metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and alert quality ratios using SIEM data. Ideal for SOC leadership, compliance auditing, and continuous process improvement initiatives needing quantifiable security posture reporting.

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This guide details a structured threat hunting methodology designed to proactively detect sophisticated spearphishing campaigns. It instructs users on correlating indicators across email logs, endpoint telemetry (EDR), and network data (SIEM) to identify targeted threats, supporting incident response and security posture improvement.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.