Skill UI

This module is designed to document, track, and manage quality nonconformance issues found during manufacturing or process audits. It is essential for root cause analysis, implementing corrective and preventive actions (CAPA), and ensuring compliance with industry quality standards. Use it when recording deviations from specified requirements.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

This skill guides the implementation of comprehensive Identity Governance and Lifecycle Management (IGM) processes. It automates the entire employee identity lifecycle—from pre-hire onboarding (Joiner) to role changes (Mover) and termination (Leaver). Key components include Role-Based Access Control (RBAC) provisioning, periodic access recertification, and remediation of orphaned accounts, ensuring compliance with standards like SOX and GDPR.

This guide details the systematic process of creating comprehensive incident response playbooks and runbooks. It covers structured procedures, decision trees, RACI matrices, and escalation protocols for various incident types (e.g., ransomware, data breach). Designed for maturing an Incident Response (IR) program, maintaining compliance (SOC 2, HIPAA), and integrating automated workflows into SOAR platforms, aligning with NIST SP 800-61r3 standards.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

This comprehensive guide details how to implement robust security hardening measures for LDAP directory services. It specifically addresses critical vulnerabilities like LDAP injection, anonymous binding, and channel binding bypass. Key features include mandatory LDAPS enforcement, granular access control list configuration, and integrating advanced monitoring to ensure the infrastructure meets high compliance standards (e.g., NIST 800-53). Essential for security architects and operations teams.

This skill provides a comprehensive guide to implementing microsegmentation policies. It details how to move beyond traditional network boundaries (VLANs) to enforce least-privilege access control between individual workloads using identity and application context. Essential for preventing lateral movement and establishing a robust zero-trust architecture aligned with industry compliance standards.

This guide details the comprehensive deployment of Cisco Duo Multi-Factor Authentication across critical access points like VPN, RDP, SSH, and web applications. It covers setting up the Duo Authentication Proxy, implementing adaptive access policies based on risk and device health, and deploying phishing-resistant methods like WebAuthn/FIDO2, ensuring compliance with NIST standards. Use this when hardening identity access management or establishing robust security controls.

This guide details the robust process of implementing VLAN-based (802.1Q) network segmentation on managed switches. It is crucial for isolating critical zones—such as DMZ, servers, and IoT—to meet strict compliance standards (PCI-DSS, HIPAA) and significantly limiting the blast radius during a security incident by controlling lateral movement. Includes port hardening and ACL configuration.

A comprehensive guide to implementing and validating Transport Layer Security (TLS) 1.3. This skill covers configuring modern cipher suites, key exchange groups, and enforcing perfect forward secrecy (PFS). Use this when deploying secure communication protocols, hardening network services, meeting compliance standards, or performing deep security assessments on web servers and applications.

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.