Skill UI

This skill analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework. It identifies which attack phases an adversary has completed, points where defenses failed or succeeded, and recommends controls to disrupt the attack at earlier stages. It is essential for post-incident analysis, threat intelligence reporting, and designing robust defense-in-depth strategies.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.

This guide provides comprehensive strategies for scaling datasets that exceed the capacity of a single node. It covers various architectural patterns, including multi-tenancy with payload partitioning and sliding time window management. We detail the full scaling progression, from optimizing a single node (Vertical Scaling) to distributing data across multiple nodes via sharding (Horizontal Scaling), ensuring reliable handling of massive, growing datasets.