Skill UI

A comprehensive guide to deploying Microsoft Sentinel as a cloud-native SIEM/SOAR solution. Covers multi-cloud data connector setup (AWS, Azure, GCP), writing advanced KQL queries for threat detection and hunting, and building automated response playbooks using Logic Apps. Ideal for establishing centralized SOCs in complex, multi-cloud environments.

This guide details the systematic process of creating comprehensive incident response playbooks and runbooks. It covers structured procedures, decision trees, RACI matrices, and escalation protocols for various incident types (e.g., ransomware, data breach). Designed for maturing an Incident Response (IR) program, maintaining compliance (SOC 2, HIPAA), and integrating automated workflows into SOAR platforms, aligning with NIST SP 800-61r3 standards.

A structured guide for conducting blameless post-mortem reviews after any security incident. This process helps identify root causes using techniques like the 5 Whys, calculates critical metrics (MTTD, MTTR), and generates actionable recommendations to continuously improve incident response playbooks and procedures.

A comprehensive guide for deploying and operationalizing Amazon GuardDuty. It provides continuous, intelligent threat detection across core AWS services including S3, EKS, and EC2 runtime monitoring. Use this skill to investigate suspicious activity, detect compromised credentials, or build automated incident response playbooks using EventBridge and Lambda for proactive security.

This skill guides the implementation of Security Orchestration, Automation, and Response (SOAR) workflows using platforms like Splunk Phantom. It automates the entire incident lifecycle, including alert triage, IOC enrichment (via VirusTotal, CrowdStrike), containment actions, and ticket creation (ServiceNow). Ideal for SOC teams needing to reduce Mean Time To Respond (MTTR) and standardize complex security procedures across multiple tools.

A comprehensive guide to building a structured incident response playbook for ransomware attacks. It aligns with the CISA StopRansomware Guide and NIST CSF, covering all phases from preparation and detection to containment, eradication, and recovery. Ideal for security teams conducting readiness assessments or updating compliance documentation.

A comprehensive runbook for responding to critical incidents involving Flexport API integrations. It covers various failure scenarios, including complete API outages, webhook delivery loss, and complex supply chain data synchronization issues. The guide provides severity classification (P1-P4), diagnostic commands, and step-by-step playbooks for rapid triage and mitigation.

This comprehensive runbook provides detailed procedures for diagnosing and resolving critical incidents within the Glean enterprise search platform. It covers all severity levels (P1-P4) and failure modes, including API outages, connector synchronization failures, indexing backlogs, and permission drift. It includes diagnostic steps, advanced troubleshooting playbooks, and communication templates for technical support and engineering teams.

A comprehensive guide for rapid incident response for Palantir Foundry systems. This runbook provides structured steps for triage, severity classification (P1-P4), and detailed playbooks for common issues like authentication failures, rate limiting, and build pipeline errors. It guides users through investigation, mitigation, and postmortem documentation to minimize downtime and ensure quick recovery.