Skill UI

This skill provides expert-level diagnostic capabilities for complex distributed systems. It specializes in analyzing production incidents, identifying deep root causes, and designing comprehensive observability solutions. Use this when investigating recurring errors, reviewing system logs/traces, and implementing preventative reliability measures.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

Leverage Eric Zimmerman's EZ Tools suite for comprehensive Windows forensic artifact analysis. This guide details how to parse critical system data, including the Master File Table (MFT), registry hives, prefetch files, and event logs. Essential for digital forensics investigators and incident responders conducting deep system analysis.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This script generates a comprehensive diagnostic bundle for CAST AI deployed on a Kubernetes cluster. It automatically collects crucial data including component logs, pod statuses, Helm releases, node inventories, and cluster events into a single archive. Use this tool when preparing a detailed support ticket or performing deep technical troubleshooting.

This guide provides a comprehensive framework for investigating production issues on the Nexu platform using the Datadog Logs API. It details how to query crash events, analyze OpenClaw stderr output, check gateway startup status, and review API request logs (including 5xx errors). It includes best practices for authentication, filtering by pod/time, and parsing raw JSON logs using Python for actionable insights.

This guide provides methods for robust monitoring and automation tailored for services deployed on Fly.io. It covers key areas including polling the Machines API to detect state changes, implementing comprehensive health check endpoints, processing structured logs using tools like `jq`, and automating deployment notifications within CI/CD pipelines. Essential for achieving high availability and reliable operations.

WizTelemetry Notification is the core notification component of the KubeSphere observability platform. It ingests alerts, cloud events, and audit logs in a multi-tenant Kubernetes environment. It intelligently routes and distributes notifications to various channels (Email, Slack, DingTalk, etc.) based on sophisticated label matching and predefined routing rules, ensuring reliable and targeted communication in complex cloud deployments.