Skill UI

This skill automates the validation of AWS environments against critical industry compliance benchmarks. It performs detailed checks for CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2 standards, covering key areas like Identity and Access Management (IAM), logging, data protection, and network security. Essential for preparing for regulatory audits and maintaining continuous secure operations.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

This guide provides a comprehensive methodology for conducting cloud security audits across major platforms (AWS, Azure, GCP) using industry-standard CIS Benchmarks. It covers selecting appropriate benchmark versions, running automated assessments using tools like Prowler and ScoutSuite, interpreting complex compliance results, and prioritizing systematic remediation steps to achieve and maintain continuous compliance (e.g., SOC 2, ISO 27001).

This tool assists in defining a structured Security Operations Center (SOC) escalation matrix. It maps incident response procedures based on severity (P1-P4), asset criticality, and business impact. Users can model tiered response paths, set Service Level Agreements (SLAs), and implement context-driven automatic escalation triggers to ensure rapid and consistent handling of cybersecurity incidents.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

This solution automates the processing of AWS GuardDuty findings using EventBridge and AWS Lambda. It enables real-time incident response capabilities, including automatic quarantine of compromised EC2 resources, comprehensive forensic snapshot creation, and immediate high-severity security notifications via SNS. Ideal for SOC teams seeking to drastically reduce Mean Time To Response (MTTR) and strengthen cloud security posture.

This skill detects unauthorized modifications (container drift) to running containers by monitoring for deviations from the original image state. It monitors binary execution drift, file system changes, and configuration deviations using tools like Falco and Kubernetes security contexts. Essential for SOC analysts and security teams investigating runtime compromises and enforcing immutable infrastructure.

This skill provides advanced runtime security rules using Falco, a CNCF-graduated tool. It monitors Linux syscalls to detect container escape attempts in real-time, identifying techniques such as mounting host filesystems, unauthorized namespace access (nsenter), and privileged container launches. It is crucial for SOC analysts and security teams enhancing cloud-native security coverage.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This guide details advanced methods for detecting and preventing QR code phishing (quishing) attacks. It covers how malicious URLs embedded in images bypass traditional email security filters, requiring multimodal AI, OCR, and robust mobile threat defense solutions. Essential for SOC analysts and security teams.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

Executes comprehensive red team exercises that mimic real-world adversary operations across people, processes, and technology. This capability simulates the full attack lifecycle, from initial reconnaissance to objective completion, specifically testing an organization's detection, response, and containment mechanisms. It focuses on adversary emulation and complex attack chains, differentiating it from standard vulnerability scanning or penetration testing.