Skill UI

This skill provides comprehensive guidance on configuring Fluentd and Fluent Bit for centralized log collection, routing, filtering, and enrichment. It covers setting up lightweight log forwarders on endpoints and designing central aggregators that route data to SIEM tools, Elasticsearch, or Splunk. Essential for achieving observability and meeting strict security compliance requirements.

This skill provides a comprehensive guide to implementing advanced memory protection mechanisms on Windows endpoints. It covers critical techniques like Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG). Use this when hardening systems against various memory corruption exploits, such as buffer overflows and ROP chains, to significantly boost overall security posture.

This guide details the implementation of robust network access control (NAC) using 802.1X, RADIUS authentication, and platforms like PacketFence. It enables identity-based access enforcement, performs endpoint posture assessment, and dynamically assigns users to appropriate VLANs. Ideal for achieving zero-trust architecture and meeting stringent compliance standards (e.g., PCI-DSS).

This skill guides the deployment and comprehensive configuration of Rapid7 InsightVM. It covers setting up the Security Console and distributed Scan Engines for both authenticated and unauthenticated vulnerability scanning. Learn how to manage diverse scan templates (e.g., PCI, HIPAA), utilize various credential types (SSH, WMI), and integrate endpoint assessment for robust cybersecurity posture management.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

This guide details how to implement NextDNS as a zero-trust DNS filtering layer. By utilizing encrypted resolution (DoH/DoT) and real-time threat intelligence, it blocks malicious domains, prevents data exfiltration, filters ads/trackers, and enforces granular security policies across all endpoints, aligning with Zero Trust principles and enhancing overall network security.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

This skill automates GraphQL introspection to extract the complete API schema, including types, queries, mutations, and subscriptions. It is designed to map the entire attack surface, helping authorized testers identify sensitive endpoints and test for vulnerabilities such as query depth abuse, batching attacks, and resource exhaustion. Ideal for comprehensive API security assessment.