Skill UI

Provides a comprehensive guide on installing, configuring, and tuning the Snort 3 Intrusion Detection System. This skill covers setting up network interfaces for promiscuous monitoring, writing custom rulesets, optimizing detection coverage, and integrating alerts with SIEM platforms to monitor network boundaries for malicious activity.

This skill guides the implementation of File Integrity Monitoring (FIM) using AIDE (Advanced Intrusion Detection Environment). It covers setting up AIDE configurations, creating initial baselines, performing scheduled integrity checks, and parsing detailed change reports. This is essential for maintaining strong security controls, meeting compliance requirements, and detecting unauthorized system modifications on Linux environments.

This skill guides the deployment of canary tokens and honeytokens across critical systems, such as fake AWS credentials, DNS records, and document beacons. These decoys are designed to trigger immediate alerts via webhooks when accessed by attackers, serving as a powerful early warning system for breach detection and intrusion detection.

Suricata is a high-performance, open-source network threat detection engine used for deep packet inspection. This skill details the deployment and configuration of Suricata in Intrusion Prevention System (IPS) mode. It covers setting up custom rules, integrating third-party rulesets (like Emerging Threats), and actively blocking malicious traffic in real time, making it essential for robust network security and compliance enforcement.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.