Skill UI

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

This guide is designed for threat hunting, helping security teams proactively detect persistent unauthorized access methods. It focuses on identifying malicious inbox/mail-flow forwarding rules that adversaries establish after a compromise to maintain access to corporate communications, often associated with Business Email Compromise (BEC) or T1114 techniques. Use during incident response and proactive security assessments.

Execute deep, stealthy red team exercises that emulate real-world sophisticated adversaries. This process maps attacks to the MITRE ATT&CK framework, testing an organization's entire security posture—including detection, incident response, and containment capabilities (Blue Team). It is designed for simulating full attack lifecycles (initial access, lateral movement, exfiltration) to validate security investments and meet regulatory requirements (TIBER-EU, CBEST). Requires executive authorization and defined Rules of Engagement.

A comprehensive guide to deploying and configuring Wazuh SIEM/XDR for robust endpoint detection and response. This skill covers agent authentication and management via API, creating custom decoders and rules, querying security alerts, and validating rule logic using logtest functionality.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This comprehensive skill provides in-depth guidance for authors targeting Advanced Materials. It covers journal positioning, scope fit (e.g., soft matter, 2D materials, energy), the required depth of evidence (methodology and characterization), and specific house style rules. Use this to re-frame your manuscript and ensure it meets the high standards for performance claims and scientific rigor expected by top-tier materials journals.

A comprehensive guide for structuring high-impact scientific papers in advanced materials. It teaches authors how to build a cohesive narrative around a single central scientific advance, emphasizing the crucial causal chain: Structure → Property → Function. It also provides rules for optimizing the opening paragraph to serve as a self-contained abstract.

A detailed guide on positioning a computer architecture paper within the broader academic literature. It teaches authors to write a 'lineage with structural deltas,' moving beyond mere citation lists. The guidelines cover sweeping multiple databases (like dblp and IEEE Xplore), identifying concrete structural improvements (deltas), and adhering to strict academic rules, such as citing all authors and maintaining un-blinded bibliography integrity.

This guide provides structured rules for authors writing sensor-systems or information-processing papers. It emphasizes leading with the physical sensing problem, requiring real-hardware measurements for energy, latency, and ground truth, and adhering to strict academic formatting constraints. Use this when revising submissions to ensure technical depth and practical deployability.