Skill UI

This system maps advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework. Utilizing the attackcti library to query STIX/TAXII data, it generates specialized ATT&CK Navigator layer files. It is essential for security analysts to profile threat actors, visualize comprehensive coverage heatmaps, and precisely assess detection gaps against sophisticated adversaries.

This tool queries a MISP (Malware Information Sharing Platform) instance via PyMISP to compute detailed event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends. It generates comprehensive threat landscape reports, visualizing temporal trends. Use it when investigating security incidents, summarizing top threat actors or malware families, or producing a formal Cyber Threat Intelligence (CTI) report.

A comprehensive guide to building an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. This skill teaches how to leverage OpenCTI's native STIX 2.1 model and internal connectors to pull deep context from major external threat intelligence sources like VirusTotal, Shodan, AbuseIPDB, and GreyNoise. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and generates confidence scores for rapid analyst prioritization.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

This skill provides a comprehensive guide on integrating Cyber Threat Intelligence (CTI) feeds using STIX 2.1 and TAXII 2.1 standards. It demonstrates how to build both consumer and producer capabilities in Python, covering server discovery, polling collections, and parsing complex STIX objects (Indicators, Malware, Threat Actors). Ideal for professionals building SIEM/TIP integrations or advanced security architectures.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers. It normalizes various threat intelligence objects (indicators, actors) into platform-native schemas, enabling automated ingestion, validation, and routing to SIEM, TIP, and EDR systems. Ideal for integrating new ISAC feeds or building bi-directional intelligence pipelines.

Spawns N parallel AI subagents that compete on the same task using isolated git worktrees. A coordinator dispatches, monitors, evaluates results by metric or LLM judge, then merges the winning branch. Ideal for parallel optimization, content variations, refactors, and research exploration.

This skill generates user-friendly, public-facing release notes (changelogs) for App Stores. It analyzes the raw Git history since the last tag, intelligently filtering out internal commits (like refactors, CI updates, or build scripts) and grouping visible changes into concise, benefit-focused bullet points suitable for a "What's New" section.