Skill UI

This tool assists in defining a structured Security Operations Center (SOC) escalation matrix. It maps incident response procedures based on severity (P1-P4), asset criticality, and business impact. Users can model tiered response paths, set Service Level Agreements (SLAs), and implement context-driven automatic escalation triggers to ensure rapid and consistent handling of cybersecurity incidents.

This framework provides a comprehensive solution for tracking vulnerability aging and measuring remediation performance against defined Service Level Agreements (SLAs). It helps organizations enforce severity-based timelines, calculate key performance indicators (KPIs) like Mean Time to Remediate (MTTR), and automate escalation procedures to ensure continuous compliance and improve overall security posture.

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

Provides a comprehensive guide on installing, configuring, and tuning the Snort 3 Intrusion Detection System. This skill covers setting up network interfaces for promiscuous monitoring, writing custom rulesets, optimizing detection coverage, and integrating alerts with SIEM platforms to monitor network boundaries for malicious activity.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

A comprehensive guide for security professionals on detecting and preventing ARP spoofing and poisoning attacks. The skill covers multiple layers of defense, including implementing Dynamic ARP Inspection (DAI) on managed switches, utilizing ARPWatch for continuous monitoring, performing deep packet inspection with Wireshark, and developing custom Python scripts for real-time anomaly detection. Essential for mitigating Man-in-the-Middle (MitM) attacks at Layer 2.

This solution automates the processing of AWS GuardDuty findings using EventBridge and AWS Lambda. It enables real-time incident response capabilities, including automatic quarantine of compromised EC2 resources, comprehensive forensic snapshot creation, and immediate high-severity security notifications via SNS. Ideal for SOC teams seeking to drastically reduce Mean Time To Response (MTTR) and strengthen cloud security posture.

This skill provides comprehensive anomaly detection for Modbus/TCP and Modbus RTU traffic in Operational Technology (OT) and Industrial Control Systems (ICS). It monitors function codes, validates register access, analyzes timing, and detects unauthorized clients. By utilizing advanced tools like Zeek, Suricata, and custom Python models, it helps establish behavioral baselines and identify potential cyber threats.

This skill provides a comprehensive guide to deploying Zeek (formerly Bro) for passive network security monitoring. It details how to generate structured logs (DNS, HTTP, SSL, etc.) and write custom Zeek scripts to detect sophisticated anomalies like DNS tunneling and beaconing. Ideal for threat hunting, security incident response, and complementing traditional IDS solutions.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This skill automates the entire iterative process of Design Space Exploration (DSE), primarily for computer architecture and EDA problems. It executes complex programs, analyzes resulting objective metrics, and intelligently tunes input parameters (e.g., cache size, pipeline width, optimization passes). It continues iterating until a predefined objective is met or a timeout is reached, making it ideal for optimizing complex system and hardware configurations.

This skill guides the comprehensive evaluation and selection of Threat Intelligence Platforms (TIPs). It assesses vendor capabilities, including STIX/TAXII support, workflow automation, SIEM/SOAR integration, and total cost of ownership. It is essential for procurement decisions, migrating between TIP solutions, or assessing whether the current CTI program meets required maturity levels.