Skill UI

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

This skill is designed for deep security and behavioral analysis within the Kubernetes control plane. It specializes in tracing complex interactions, including RBAC edge cases, service-account trust paths, admission webhook behavior, resource mutation, and cluster-level state drift. Use it when diagnosing why live workloads differ from manifest declarations, or when investigating cluster-wide permission issues.