Skill UI

This skill guides proactive security auditing and threat hunting for registry-based persistence artifacts (MITRE T1547) in Windows environments. It focuses on identifying mechanisms such as Run/RunOnce keys, Winlogon modifications, IFEO debugger injection, and COM hijacking to detect malware autostart techniques and scope compromises during incident response.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.

This tool systematically generates, validates, and ranks concrete, publishable research ideas based on a broad research direction provided by the user. It guides the user through the entire idea discovery pipeline, from initial landscape survey (Phase 1) to validation (novelty checks, experiments) and review, ensuring the generated ideas are novel and relevant for academic publication. It manages complex workflow orchestration and utilizes multiple external tools.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This comprehensive guide details how to design, deploy, and measure a robust anti-phishing security awareness program. By combining regular simulations, interactive role-based learning modules, and metric tracking, organizations can build a strong security-conscious culture. It covers initial baseline assessments, continuous difficulty scaling, and compliance alignment using industry-leading tools like KnowBe4 and Proofpoint.

A comprehensive guide for implementing centralized security controls on API gateways (e.g., Kong, AWS API Gateway, Azure APIM). It covers critical defense layers including JWT-based authentication enforcement, advanced rate limiting and throttling, request validation against schemas, TLS termination, and Web Application Firewall (WAF) integration. Use this when establishing a robust, layer-7 security posture for microservice APIs.

This comprehensive guide details the implementation of Cloud Data Loss Prevention (DLP) using industry-leading tools such as Amazon Macie, Google Cloud DLP, and Azure Information Protection. It provides structured workflows for discovering, classifying, de-identifying, and protecting sensitive data (PII, PHI, financial data) across cloud storage, databases, and data pipelines. Essential for achieving compliance with global regulations (GDPR, HIPAA, PCI DSS) and integrating robust data governance into CI/CD processes.

This skill covers the deployment and fine-tuning of Web Application Firewall (WAF) rules across major cloud platforms like AWS, Azure, and Cloudflare. It addresses critical security needs such as mitigating OWASP vulnerabilities (SQLi, XSS), managing bot traffic, implementing rate limiting, and ensuring compliance (e.g., PCI-DSS). The workflow guides users through deploying managed rule sets, creating custom rate-based logic, and minimizing false positives.

This guide details implementing robust code signing for various build artifacts, including binaries, packages, and containers. It covers both traditional GPG key-based signing and modern, keyless signing using Sigstore/cosign. Use this process to establish verifiable trust chains, ensure artifact integrity against supply-chain tampering, prove authenticity, and meet advanced security standards like SLSA.

Configure Microsoft Entra ID (Azure AD) Conditional Access policies to enforce zero trust access control. This skill covers critical areas such as signal-based policy design, device compliance requirements, risk-based authentication, named locations, and session controls, aligning with NIST SP 1800-35. Essential for deploying, hardening, or assessing robust Azure AD security architecture.

Utilizes Google Distroless images and multi-stage Docker builds to drastically reduce container attack surface. By eliminating unnecessary OS components like shells, package managers, and core utilities, this technique is essential for hardening container security, meeting compliance requirements, or mitigating risks associated with bloated base images.

This skill guides the implementation and auditing of advanced network segmentation within Kubernetes using Calico. It enables establishing zero-trust microsegmentation by creating and managing NetworkPolicy and GlobalNetworkPolicy resources. Use this to strictly control pod-to-pod traffic, enforce namespace isolation, restrict egress rules, and apply DNS-based security policies, significantly hardening your cluster's security posture.