Skill UI

A comprehensive SRE/DevOps framework guiding teams through the entire incident lifecycle: detection, response, resolution, and post-mortem. Features include automated severity classification, timeline reconstruction from scattered logs, and structured Post-Incident Review (PIR) generation, enabling effective command and control during major outages.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This guide details advanced threat hunting techniques to proactively detect Mimikatz execution. It focuses on identifying command-line patterns, unauthorized access to LSASS memory, binary indicators, and known credential dumping techniques (e.g., DCSync, Golden Tickets). Ideal for security analysts, threat hunters, and incident response teams during proactive assessments or active compromise investigation.

This skill guides the implementation of full disk encryption using Microsoft BitLocker on Windows endpoints. It covers best practices for deploying encryption via GPO, Intune, and command line, ensuring data-at-rest protection. Use this when meeting compliance requirements (PCI, HIPAA) or securing mobile workstations against physical loss or theft.

This guide provides a comprehensive workflow for recovering deleted files from forensic disk images and storage media. Utilizing PhotoRec and file signature carving techniques, it addresses scenarios where file systems are corrupted, formatted, or metadata is unavailable. The process includes setup, running the recovery tool in both interactive and command-line modes, and advanced steps for organizing, hashing, and validating file integrity.

A comprehensive guide and pattern library for reviewing, troubleshooting, and safely modifying Cisco IOS and IOS-XE configurations. This skill outlines best practices for using read-only 'show' commands, validating ACL wildcard masks, managing configuration hierarchy, and following stringent change control procedures to prevent network disruptions.