Skill UI

This tool provides a comprehensive workflow for performing deep forensic investigations on AWS environments. By leveraging CloudTrail logs and programmatic access via boto3/Athena, users can reconstruct attacker activity, identify compromised credentials, analyze suspicious API call patterns, and generate detailed incident response reports.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

This comprehensive guide outlines the end-to-end workflow for mobile device forensics, covering data acquisition and analysis for both iOS and Android platforms. It details techniques using commercial tools like Cellebrite UFED and open-source utilities (ALEAPP, iLEAPP, ADB). This methodology is critical for investigating deleted messages, call logs, location data, and application artifacts in legal or corporate investigations.

A comprehensive guide for performing systematic security assessments on web applications. Following the OWASP Web Security Testing Guide (WSTG), this process identifies critical vulnerabilities such as broken authentication, authorization flaws (IDOR), SQL injection, and Cross-Site Scripting (XSS). The workflow covers reconnaissance, mapping, and advanced testing techniques using tools like Burp Suite and sqlmap, ensuring deep coverage beyond automated scanner capabilities. Ideal for pre-production security validation and compliance audits.

This guide provides a comprehensive workflow for recovering deleted files from forensic disk images and storage media. Utilizing PhotoRec and file signature carving techniques, it addresses scenarios where file systems are corrupted, formatted, or metadata is unavailable. The process includes setup, running the recovery tool in both interactive and command-line modes, and advanced steps for organizing, hashing, and validating file integrity.

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.

This skill guides the implementation of comprehensive security controls for container registries. It details workflows for vulnerability scanning using Trivy and Grype, generating Software Bill of Materials (SBOMs) with Syft, and enforcing image authenticity using Cosign and Sigstore. It is essential for building robust CI/CD pipelines and preventing supply chain attacks by ensuring only scanned, signed, and compliant images are deployed.

Harbor is an open-source container registry designed for robust security and compliance. This guide details the comprehensive workflow for securing your container ecosystem by implementing advanced features such as vulnerability scanning (Trivy), image signing (Notary/Cosign), Role-Based Access Control (RBAC), and content trust policies. Learn how to enforce image provenance and maintain strict access control in Kubernetes environments.

A comprehensive guide for systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks. This includes practical workflows for testing critical vulnerabilities such as Broken Object Level Authorization (BOLA), broken authentication, excessive data exposure, and rate limiting, using tools like Burp Suite, Postman, and ffuf. Ideal for pre-deployment audits and authorized penetration testing engagements.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.