Skill UI

An expert in designing, implementing, and optimizing scalable, reliable, and cost-effective data pipelines for both batch and streaming data. Covers advanced topics including ETL/ELT patterns, Kappa/Lambda architectures, workflow orchestration (Airflow/Prefect), transformation using dbt/Spark, and managing modern storage formats like Delta Lake and Iceberg. Focuses heavily on data quality, monitoring, and cost optimization strategies.

This skill provides a comprehensive workflow for identifying, unpacking, and analyzing packed malware samples, especially those utilizing the UPX format. It details methods for standard UPX decompression and advanced techniques for repairing modified PE headers or magic bytes that prevent automated extraction. The process supports preparing samples for deep static analysis and dynamic debugging.

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

This utility performs comprehensive forensic analysis on memory dumps. It leverages industry-standard tools like Volatility and Mimikatz to extract sensitive information, including cached credentials, NTLM/LM hashes, Kerberos tickets, and authentication tokens. It is crucial for incident response, assessing the scope of credential compromise, and investigating lateral movement attacks.

This skill guides the deployment and configuration of a TAXII 2.1 server using OpenTAXII. It enables automated, standardized exchange of STIX-formatted cyber threat intelligence (CTI) indicators between organizations. Use cases include establishing secure threat sharing pipelines, integrating with SIEM/SOAR platforms, and meeting stringent compliance requirements.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

This guide details the comprehensive process of onboarding new log sources into Security Information and Event Management (SIEM) platforms. It covers critical steps including data source discovery, configuring collectors (e.g., Syslog, Splunk UF, CloudTrail), building parsers, normalizing fields to a common schema, and validating data quality. This systematic approach is essential for achieving complete security visibility and effective threat detection across the enterprise.

This guide provides a comprehensive workflow for recovering deleted files from forensic disk images and storage media. Utilizing PhotoRec and file signature carving techniques, it addresses scenarios where file systems are corrupted, formatted, or metadata is unavailable. The process includes setup, running the recovery tool in both interactive and command-line modes, and advanced steps for organizing, hashing, and validating file integrity.

The skill generates professional diagrams (flowcharts, architecture, UML, ERD) using the native draw.io desktop CLI. It creates editable .drawio XML files and exports them to common formats like PNG, SVG, PDF, and JPG. Ideal for visualizing complex systems, data flows, or component relationships.

Collects comprehensive diagnostics from an unresponsive Oracle Cloud Infrastructure (OCI) compute instance. This tool gathers critical data—including serial console logs, cloud-init logs, VCN flow logs, and CPU metrics—into a single, self-contained tar archive. Use this when an instance is failing, stuck in provisioning, or showing underlying infrastructure errors, providing support teams with all necessary information for root-cause analysis.

This advanced playbook details expert techniques for format string exploitation. It covers arbitrary stack reading (%p), memory writing (%n), and exploiting weaknesses like GOT/hook overwrites. Essential for CTF challenges and binary vulnerability analysis to achieve reliable Remote Code Execution (RCE).

This skill generates a formal Architecture Decision Record (ADR) following industry-standard formats. It guides users through documenting the full rationale behind significant technical choices, ensuring that the context, alternatives considered, chosen option, and resulting trade-offs are all captured. Ideal for maintaining architectural integrity and knowledge transfer within engineering teams.