Skill UI

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

A specialized downstream skill for deep security analysis of JSON Web Tokens (JWT), JWS, and JWE. It guides the identification of vulnerabilities where token components (headers, claims, keying) lead to unauthorized identity assumption or privilege escalation. Use this to trace the full path from token supply to final application acceptance.

This guide provides a systematic framework for authorized email security reviews. It covers advanced phishing analysis, including deep dives into email headers, assessing SPF/DKIM/DMARC compliance, identifying Business Email Compromise (BEC) patterns, and researching mailbox token abuse. It is essential for incident response, threat intelligence, and security architecture review.