Skill UI

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

This skill provides comprehensive guidance on detecting network reconnaissance and port scanning activities using industry-standard IDS/IPS systems like Suricata and Snort. It covers various scanning techniques (e.g., SYN, FIN, NULL, Xmas scans, UDP sweeps) and advanced detection methods, including signature matching, threshold-based alerting, and traffic anomaly analysis to identify tools like Nmap and Masscan.

This skill establishes normal network communication patterns by analyzing historical NetFlow/IPFIX data. Utilizing Python pandas, it computes hourly/daily volume distributions, per-host statistics, and top-talker profiles. Anomalies are detected using sophisticated statistical methods like z-score and IQR, allowing SOC analysts to quickly identify deviations such as data exfiltration spikes, persistent beaconing, or unusual port usage.

A guide and implementation pattern for deploying Nozomi Networks Guardian sensors. This solution enables passive, non-disruptive monitoring of Operational Technology (OT) and Industrial Control Systems (ICS). It provides critical asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment, making it essential for building robust OT Security Operations Centers (SOCs) and ensuring compliance without risking live operations.

Provides methodology and scripts for proactive threat hunting, IOC sweeps, and statistical anomaly detection that surface attacker activity before automated alerts fire.

Aeon is a scikit-learn compatible Python toolkit for time series machine learning, covering classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search with specialized algorithms.

This comprehensive benchmark suite evaluates the performance of Vision-Language Models (VLM) on complex video anomaly detection tasks using the SmartHome-Bench dataset. It covers a wide range of real-world smart home scenarios, including security breaches, elderly fall detection, and unusual pet behavior. Unlike single-frame analysis, this benchmark requires deep multi-frame video understanding, making it a robust tool for testing the advanced AI capabilities of video monitoring systems.

Analyzes options chain data by separating real calls and puts from lottery-like speculative contracts to produce more reliable put/call sentiment, anomaly detection, and expiry breakdowns for watchlists, sectors, and event-driven names.

This tool performs robust outlier detection on individual session spending. Utilizing Median and Median Absolute Deviation (MAD), it calculates a modified z-score, making it highly resistant to extreme values, unlike mean+sigma methods. It specifically identifies which singular sessions are anomalous, making it crucial for cost monitoring, auditing, and integrating into CI/CD pipelines to prevent unexpected resource overruns.