Skill UI

This skill facilitates the creation of real-time incident response dashboards across major SIEM platforms (Splunk, Elastic, Grafana). It provides SOC analysts and leadership with unified situational awareness by tracking affected systems, containment status, Indicators of Compromise (IOC) spread, and the entire incident response timeline, crucial for coordination and post-incident reporting.

A comprehensive skill for optimizing Role-Based Access Control (RBAC) structures. It applies advanced data mining techniques, including clustering (k-means, agglomerative) and Formal Concept Analysis (FCA), to analyze existing user-permission assignments. The goal is to discover the minimal set of necessary roles, thereby preventing 'role explosion,' enforcing the least privilege principle, and ensuring robust identity governance for secure systems.

This guide details the deployment and usage of MISP (Malware Information Sharing Platform) to centralize, correlate, and distribute threat intelligence. It covers architectural concepts, integrating diverse OSINT and commercial feeds (like abuse.ch, AlienVault OTX), and automating the flow of Indicators of Compromise (IOCs) into SIEM and SOAR systems via Docker and Python APIs.

This framework provides a systematic methodology for cybersecurity professionals to transform raw threat intelligence, observed attack patterns, and environmental telemetry into verifiable, testable hunting hypotheses. It guides the end-to-end process, from hypothesis formulation and data identification across SIEM/EDR systems, to deep correlation and reporting, enabling proactive threat detection and scope assessment.

A comprehensive guide to configuring secure OAuth 2.0 authorization flows, covering best practices for Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. Learn how to implement mandatory security controls, manage token lifecycles, and align with OAuth 2.1 standards to build robust identity and access management systems.

This skill deploys advanced anomaly detection systems for Operational Technology (OT) and Industrial Control Systems (ICS). It builds multi-dimensional baselines by analyzing SCADA communications, network traffic (Modbus, DNP3, OPC UA), and timing patterns. It detects deviations, rogue devices, and potential intrusions by profiling normal behavior, complementing signature-based IDS.

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This tool scans GitHub Actions workflows and CI/CD configurations to identify critical supply chain attack vectors. It specifically checks for unpinned actions, risks from script injection using expressions, dependency confusion, and secrets exposure, helping organizations harden their build systems against sophisticated threats.

This skill provides a deep dive into implementing robust End-to-End Encryption (E2EE) for messaging applications. It simulates key components of the Signal Protocol, including X3DH for initial key exchange and the Double Ratchet algorithm for ongoing key management. It ensures forward secrecy, meaning even if a key is compromised, past messages remain secure. Use this when building highly secure, compliant communication systems.

This guide details passive OT network traffic analysis using Nozomi Networks Guardian sensors. It provides methods to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across sensitive Industrial Control Systems (ICS) without disrupting operations. It is crucial for building robust OT Security Operations Centers (SOCs) and ensuring compliance with industry standards like IEC 62443.

This guide demonstrates how to programmatically create, validate, and exchange complex structured threat intelligence objects (Indicators, Malware, Campaigns) using the STIX 2.1 standard and the stix2 Python library. It covers the full lifecycle of intelligence sharing, including defining patterns and publishing data via TAXII 2.1, making it essential for building sophisticated Threat Intelligence Platforms (TIPs) and integrating with SIEM/SOAR systems.

This comprehensive guide details industry best practices for container image hardening. It covers minimizing attack surface through multi-stage builds, utilizing distroless images, enforcing non-root users, and configuring read-only root filesystems. The techniques ensure compliance with standards like the CIS Docker Benchmark, making images secure and production-ready.