Skill UI

This comprehensive guide outlines the best practices and structured methodology for developing specialized skills for AI coding agents. It provides detailed instructions on integrating Azure SDKs and Microsoft Foundry services, covering crucial topics like secure authentication patterns (DefaultAzureCredential), modular workflow design, and maintaining concise, effective knowledge context for optimal agent performance.

This deep dive guides users through migrating complex GPU workloads, such as deep learning training pipelines, from major hyperscalers (AWS, GCP, Azure) or other cloud platforms to Vast.ai. It covers critical steps including cost comparison analysis, adapting Docker images for new environments, securely handling cloud credentials via environment variables, and implementing robust validation and rollback procedures to ensure a smooth transition.

This tool detects abnormal access patterns across major cloud storage services (AWS S3, GCS, Azure Blob Storage). By analyzing audit logs like CloudTrail, it uses statistical baselines and time-series anomaly detection to identify suspicious activities such as after-hours bulk downloads, access from new IPs, or unusual API call spikes. It is crucial for investigating potential data exfiltration incidents or building robust cloud security detection rules.

Perform comprehensive security audits across AWS, Azure, and GCP by assessing infrastructure configurations against established CIS Foundations Benchmarks. This skill guides users through running automated scans using industry tools like Prowler and ScoutSuite, interpreting failed controls, identifying security gaps, and implementing systematic remediation to ensure continuous compliance and maintain a robust security posture.

A comprehensive guide for responding to security incidents across major cloud providers (AWS, Azure, GCP). It details detection methods using cloud-native logs, containment strategies for compromising identities, evidence preservation techniques, and investigation steps for common cloud attack patterns.

Guide for assessing AWS, Azure, and GCP environments with tools such as Pacu, ScoutSuite, and Prowler to uncover IAM weaknesses, exposed storage, insecure serverless functions, and cloud-native attack chains.

A comprehensive guide covering methodologies for conducting authorized penetration testing across major cloud platforms, including AWS, Azure, and GCP. It details the shared responsibility model, techniques for exploiting IAM misconfigurations, testing for SSRF vulnerabilities to cloud metadata services, and utilizing industry tools like Pacu and ScoutSuite. Findings are mapped to the MITRE ATT&CK Cloud matrix for robust reporting.

A comprehensive guide providing detailed KQL and SPL detection queries for identifying potential abuse of Azure service principals within Microsoft Entra ID. This tool helps SOC analysts and security teams investigate complex threats like unauthorized credential addition, privileged role assignment, admin consent bypass, and enumeration, crucial for proactive threat hunting and incident response.

This skill audits Azure Blob and ADLS storage accounts for critical security misconfigurations. It checks for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, and outdated TLS versions. Using the Python SDK, it generates a detailed, risk-scored report to enhance cloud security posture management and detect potential data exposure risks.

Detect unauthorized crypto-mining in AWS, Azure, and GCP by correlating GuardDuty/Defender/SCC findings, compute anomalies, network flows, and container/serverless behaviors to validate threats and guide response.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.