Skill UI

A comprehensive, multi-phase workflow designed for Infrastructure as Code (IaC) using Terraform. It guides users through provisioning cloud resources, creating reusable modules, managing complex state, handling multi-environment deployments, and integrating robust CI/CD pipelines and security practices. Ideal for establishing scalable, repeatable, and auditable cloud infrastructure.

A comprehensive forensic workflow for detecting persistent, deep-seated malware, such as bootkits and advanced rootkits. The analysis covers multiple layers, including boot sectors (MBR/VBR), UEFI firmware modules, and kernel memory forensics. It is essential for investigating sophisticated, nation-state level threats that evade standard anti-malware and EDR solutions.

This guide details how to write and tune Falco rules to monitor Linux syscalls in real-time. It is designed to detect critical container escape techniques, such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. Ideal for security hardening, threat hunting, and incident response in Kubernetes or containerized environments.

A comprehensive guide to implementing Mimecast Targeted Threat Protection (TTP). This suite defends against sophisticated phishing, spearphishing, and Business Email Compromise (BEC) attacks by integrating four core modules: URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect. Follow the detailed workflow to secure your organizational communications and meet compliance standards.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.

A comprehensive guide for configuring and deploying the RuView wireless sensing system. It covers firmware build-time settings (sdkconfig), runtime parameters (NVS provisioning), multi-node mesh setup, and integrating advanced edge intelligence modules (ADR-041). Essential for tuning system behavior and capabilities without modifying core code.