Skill UI

This tool provides a comprehensive workflow for performing deep forensic investigations on AWS environments. By leveraging CloudTrail logs and programmatic access via boto3/Athena, users can reconstruct attacker activity, identify compromised credentials, analyze suspicious API call patterns, and generate detailed incident response reports.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

This comprehensive guide outlines the end-to-end workflow for mobile device forensics, covering data acquisition and analysis for both iOS and Android platforms. It details techniques using commercial tools like Cellebrite UFED and open-source utilities (ALEAPP, iLEAPP, ADB). This methodology is critical for investigating deleted messages, call logs, location data, and application artifacts in legal or corporate investigations.

Leverage Eric Zimmerman's EZ Tools suite for comprehensive Windows forensic artifact analysis. This guide details how to parse critical system data, including the Master File Table (MFT), registry hives, prefetch files, and event logs. Essential for digital forensics investigators and incident responders conducting deep system analysis.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

This guide details how to analyze comprehensive Zeek network logs (conn.log, smb_files.log, ntlm.log, dce_rpc.log, etc.) to detect advanced attacker techniques. It specifically targets indicators of compromise related to lateral movement, such as SMB admin share access, NTLM account spraying, and remote service execution (DCE/RPC patterns). It is a critical network forensics tool for post-incident investigation.

This advanced workflow automates the process of analyzing the operational health of specific Azure resources. It ingests and analyzes raw logs, telemetry data, and performance metrics from diverse Azure services (e.g., VMs, Web Apps, Databases). The system performs comprehensive root cause analysis, classifies issues (Critical, High, Medium), and generates actionable, step-by-step remediation plans, significantly reducing manual troubleshooting time.

This script generates a comprehensive diagnostic bundle for CAST AI deployed on a Kubernetes cluster. It automatically collects crucial data including component logs, pod statuses, Helm releases, node inventories, and cluster events into a single archive. Use this tool when preparing a detailed support ticket or performing deep technical troubleshooting.

This comprehensive guide details how to set up end-to-end observability for ClickHouse. It covers extracting key metrics using built-in system tables (e.g., query logs, merge status), integrating the metrics with Prometheus, and finally visualizing performance, throughput, and health indicators on Grafana dashboards. Essential for monitoring production-grade ClickHouse deployments and configuring reliable alerting.

This guide provides a comprehensive framework for investigating production issues on the Nexu platform using the Datadog Logs API. It details how to query crash events, analyze OpenClaw stderr output, check gateway startup status, and review API request logs (including 5xx errors). It includes best practices for authentication, filtering by pod/time, and parsing raw JSON logs using Python for actionable insights.