Skill UI

Pod Security Admission (PSA) is a built-in Kubernetes admission controller designed to enforce Pod Security Standards (Baseline, Restricted, Privileged) at the namespace level. It serves as a crucial replacement for the deprecated PodSecurityPolicy (PSP), allowing users to implement robust security controls and maintain compliance. By applying specific labels, administrators can set enforcement modes (enforce, audit, warn) to harden container environments against unauthorized privilege escalation and security risks.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill guides the integration of OWASP ZAP for Dynamic Application Security Testing (DAST) directly into CI/CD pipelines. Learn how to perform baseline, full, and API scans against running applications, interpret complex security findings, tune scan policies, and establish automated security quality gates in modern CI/CD platforms like GitHub Actions and GitLab CI. Essential for DevSecOps practices.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

A comprehensive tool designed for assessing the security posture of Programmable Logic Controller (PLC) firmware. It specializes in detecting critical vulnerabilities such as hardcoded credentials, undocumented debug interfaces, backdoor functions, and memory corruption flaws. The tool supports analyzing major industrial platforms (Siemens, Allen-Bradley) by performing static and dynamic analysis, and verifying firmware integrity against known-good baselines, adhering to standards like IEC 62443. Use only in authorized lab environments.

This skill provides comprehensive capability to discover and inventory all privileged accounts across an enterprise infrastructure. It covers domain admins, local admins, service accounts, database roles, and cloud IAM roles. It is essential for security assessments, incident response, and compliance auditing, helping to establish a complete baseline for Privileged Access Management (PAM).

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

Generates monthly progress summaries for GEO agency clients by comparing baseline and current audits, highlighting score gains, crawler access, and action-item status to prove value in retention discussions.

A comprehensive tool for establishing performance baselines across multiple dimensions. It measures Core Web Vitals (LCP, CLS, INP), API latency (p50, p95, p99), and development build efficiency. Essential for detecting performance regressions before merging code, ensuring stability in CI/CD pipelines, and comparing alternative stack implementations.

This tool monitors Modbus TCP communication within SCADA and ICS environments to detect security anomalies. It performs deep packet inspection, baselines normal communication patterns (e.g., typical function code distribution, register access), and applies statistical analysis to identify unauthorized register writes, reconnaissance attempts, or denial-of-service attacks targeting industrial control devices.

This skill monitors for regressions on deployed URLs following deployments, merges, or dependency upgrades. It performs comprehensive checks including HTTP status, console errors, network failures, performance metrics (LCP/CLS/INP), and crucial API endpoint health, ensuring service stability in production or staging environments. Supports quick checks, continuous monitoring, and differential comparison against baselines.