Skill UI

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

An advanced Intrusion Detection System (IDS) module designed for Operational Technology (OT) and ICS/SCADA environments. It monitors Modbus TCP/RTU traffic to detect unauthorized writes, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for investigating suspicious PLC register modifications and responding to industrial threats.

This skill guides the implementation of full disk encryption using Microsoft BitLocker on Windows endpoints. It covers best practices for deploying encryption via GPO, Intune, and command line, ensuring data-at-rest protection. Use this when meeting compliance requirements (PCI, HIPAA) or securing mobile workstations against physical loss or theft.

A comprehensive guide and pattern library for reviewing, troubleshooting, and safely modifying Cisco IOS and IOS-XE configurations. This skill outlines best practices for using read-only 'show' commands, validating ACL wildcard masks, managing configuration hierarchy, and following stringent change control procedures to prevent network disruptions.

rclone is a powerful, feature-rich command-line utility designed to manage files across diverse cloud storage backends, including S3-compatible services. It provides robust, reliable equivalents to core Unix commands (sync, copy, move, mount). Use this skill for all terminal-based cloud operations, such as syncing, backing up, downloading, or managing remote data securely.

A comprehensive guide and pattern library for reviewing, troubleshooting, and safely modifying Cisco IOS and IOS-XE configurations. This skill outlines best practices for using read-only 'show' commands, validating ACL wildcard masks, managing configuration hierarchy, and following stringent change control procedures to prevent network disruptions.

The Azure CLI command group for managing Azure Container Registry (ACR). This tool allows users to perform the entire ACR lifecycle, including creating registries, authenticating credentials, building and pushing container images (using cloud builds), importing images from other sources, and configuring advanced features like geo-replication, private endpoints, and webhooks. Essential for CI/CD pipelines and container deployment workflows in Azure.