Skill UI

This comprehensive skill guide details the implementation of robust and secure API authentication systems. It covers industry standards like JWT, OAuth 2.0 (including various flows), and API key management. Key features include role-based access control (RBAC), refresh token rotation, session management, and brute-force protection, ensuring secure communication for diverse service architectures.

Walks through broken authentication assessments by analyzing login flows, password policies, brute-force/credential-stuffing, and session/token security to document vulnerabilities and mitigation steps for web applications.

This skill provides a comprehensive framework for implementing robust API rate limiting. It supports advanced algorithms like sliding windows, token buckets, and fixed counters, backed by Redis for distributed state. Use it to protect endpoints from excessive requests, enforce tiered quotas (Free, Pro, Enterprise), and prevent abuse like brute-force attacks by setting per-user, per-endpoint, or per-API-key limits.

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

This skill covers implementing robust API abuse detection using advanced rate-limiting algorithms like Token Bucket and Sliding Window. It uses Redis for distributed counting and allows for adaptive limits, dynamically tightening during detected attacks and relaxing during normal traffic. Ideal for securing APIs against DDoS, brute force, and scraping attacks.

Details how to implement robust API rate limiting and throttling using advanced techniques like Token Bucket, Sliding Window, and Fixed Window algorithms. Supports per-user, per-IP, and per-endpoint quotas, utilizing Redis for distributed counting. Essential for protecting APIs against brute force, credential stuffing, and resource exhaustion attacks, returning proper HTTP 429 responses.

A comprehensive security assessment guide and script to test API rate limit vulnerabilities. It evaluates if an API's security controls can be bypassed using advanced techniques such as IP spoofing (manipulating X-Forwarded-For headers), HTTP method variations, and endpoint path traversal. Designed for penetration testing, it helps assess resilience against brute-force or resource exhaustion attacks, aligning with OWASP API Top 10 findings.