Skill UI

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This comprehensive guide details the methodology for detecting Process Hollowing (MITRE T1055.012), a critical defense evasion technique used by fileless malware. It involves analyzing memory-mapped sections, correlating EDR telemetry (Sysmon, ETW), and identifying memory mismatches between the running process and its on-disk binary image. Use this skill when investigating sophisticated, in-memory threats that masquerade as legitimate system processes.

A comprehensive guide and workflow for threat hunting suspicious PowerShell activity (T1059.001). This technique focuses on detecting advanced adversary techniques such as encoded commands, AMSI bypass, and download cradles using telemetry from EDR platforms (CrowdStrike, MDE), SIEMs (Splunk, Elastic), and Sysmon. Essential for proactive threat detection, incident response, and security assessment.

A comprehensive guide and set of detection rules for identifying OS credential dumping techniques (MITRE T1003). It leverages EDR telemetry, Sysmon process access monitoring, and Windows security event correlation to detect attacks targeting LSASS memory, SAM databases, and NTDS.dit files. Essential for proactive threat hunting and incident response.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

A comprehensive guide for security professionals to detect data exfiltration by analyzing network telemetry (Zeek, Suricata) and logs. Techniques include identifying DNS tunneling, unusual cloud uploads, and detecting large/abusive data flows across various channels during incident response and proactive threat hunting.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This advanced workflow automates the process of analyzing the operational health of specific Azure resources. It ingests and analyzes raw logs, telemetry data, and performance metrics from diverse Azure services (e.g., VMs, Web Apps, Databases). The system performs comprehensive root cause analysis, classifies issues (Critical, High, Medium), and generates actionable, step-by-step remediation plans, significantly reducing manual troubleshooting time.

This component is an essential extension for KubeSphere Observability Platform, designed for comprehensive collection, processing, and storage of Kubernetes and KubeSphere audit events. It supports various sinks, including OpenSearch and Doris, and provides an API for querying historical audit data, ensuring robust auditing capabilities for platform operations.

WizTelemetry Notification is the core notification component of the KubeSphere observability platform. It ingests alerts, cloud events, and audit logs in a multi-tenant Kubernetes environment. It intelligently routes and distributes notifications to various channels (Email, Slack, DingTalk, etc.) based on sophisticated label matching and predefined routing rules, ensuring reliable and targeted communication in complex cloud deployments.

WizTelemetry Ruler is a core extension component within the KubeSphere Observability Platform. It provides comprehensive capabilities for defining, managing, and evaluating advanced alerting rules. Users can configure rules based on native Kubernetes events, KubeSphere auditing events, and application logs, ensuring proactive monitoring and timely alerts through sinks like AlertManager.

A comprehensive guide to deploying decoy artifacts, such as fake credentials, URLs, and files, called honeytokens or canarytokens. These tokens have no legitimate operational use; therefore, any interaction with them provides a high-fidelity, low-false-positive signal of an intrusion, data theft, or insider threat. Use this technique to enhance detection in low-telemetry areas like file shares or credential stores.