Skill UI

A comprehensive runbook providing standard operating procedures for handling Granola service disruptions, ranging from minor recording failures and sync errors to full organizational outages. It guides users and IT admins through triage (P1-P4 severity), detailed remediation steps, and escalation paths to ensure business continuity.

This guide details advanced threat hunting techniques to proactively detect Mimikatz execution. It focuses on identifying command-line patterns, unauthorized access to LSASS memory, binary indicators, and known credential dumping techniques (e.g., DCSync, Golden Tickets). Ideal for security analysts, threat hunters, and incident response teams during proactive assessments or active compromise investigation.

This guide details how to hunt for DCSync attacks, a technique used to steal password hashes from Active Directory. It involves analyzing Windows Event ID 4662 to identify unauthorized DS-Replication-Get-Changes requests originating from non-domain-controller accounts. Essential for incident response and threat detection.

This skill provides comprehensive cybersecurity assessments for critical electric power infrastructure, covering EMS, SCADA, and substation automation systems. It is crucial for verifying NERC CIP compliance, analyzing IEC 61850 protocols, and securing synchrophasor (PMU) networks against advanced threats like Industroyer. Use it for regulatory audits and operational security reviews.

A comprehensive runbook for responding to critical incidents involving Flexport API integrations. It covers various failure scenarios, including complete API outages, webhook delivery loss, and complex supply chain data synchronization issues. The guide provides severity classification (P1-P4), diagnostic commands, and step-by-step playbooks for rapid triage and mitigation.

This comprehensive runbook provides detailed procedures for diagnosing and resolving critical incidents within the Glean enterprise search platform. It covers all severity levels (P1-P4) and failure modes, including API outages, connector synchronization failures, indexing backlogs, and permission drift. It includes diagnostic steps, advanced troubleshooting playbooks, and communication templates for technical support and engineering teams.

This skill provides a comprehensive checklist and detailed methodology for detecting HTTP Request Smuggling vulnerabilities. It covers various desynchronization types (CL.TE, TE.CL, TE.TE), including HTTP/2 and modern variants. Use this when penetration testing multi-server architectures, proxies, or load balancers to identify potential security bypasses, unauthorized access, or cache poisoning risks.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.