Skill UI

This skill guides the progressive adoption of the CISA Zero Trust Maturity Model (ZTMM) v2.0. It provides a comprehensive, structured roadmap for assessing and improving security architecture across five critical pillars: Identity, Devices, Networks, Applications, and Data. Learn to perform gap analysis and implement advanced controls needed to achieve optimal zero trust compliance.

A comprehensive guide for implementing Cloud Security Posture Management (CSPM) across multi-cloud environments (AWS, Azure, GCP). Learn how to use specialized tools like Prowler and ScoutSuite, combined with native cloud services (Security Hub, Defender, SCC), to continuously monitor for misconfigurations, compliance violations (CIS, SOC 2), and security drifts, thereby enforcing security guardrails in complex cloud architectures.

This skill details the deployment of Cisco Identity Services Engine (ISE) for comprehensive network access control. It utilizes 802.1X, MAC Authentication Bypass (MAB), and posture assessment to centralize policy enforcement. ISE acts as a RADIUS policy server, providing dynamic VLAN assignment, downloadable ACLs, and robust authentication for both wired and wireless enterprise environments.

This guide provides a systematic, step-by-step workflow for Security Operations Center (SOC) analysts to perform alert triage using Elastic Security SIEM. It covers initial alert assessment, context gathering using advanced ES|QL queries, threat intelligence enrichment, and final classification decisions (True Positive, False Positive, etc.) to rapidly determine genuine security threats and prioritize incident response actions.

A comprehensive guide and workflow for performing authorized penetration testing on AWS environments using the open-source Pacu framework. This skill covers enumerating IAM configurations, identifying privilege escalation paths, testing credential harvesting, and validating security controls across S3, EC2, Lambda, and Secrets Manager. It is designed for red team exercises and risk assessment when auditing cloud infrastructure security.

This comprehensive guide details industry best practices for container image hardening. It covers minimizing attack surface through multi-stage builds, utilizing distroless images, enforcing non-root users, and configuring read-only root filesystems. The techniques ensure compliance with standards like the CIS Docker Benchmark, making images secure and production-ready.

This skill implements a sophisticated risk-based prioritization engine by combining three critical data sources: the CISA Known Exploited Vulnerabilities (KEV) catalog, the Exploit Prediction Scoring System (EPSS), and traditional CVSS scores. It allows security teams to move beyond simple severity ratings, focusing remediation efforts on vulnerabilities confirmed to be actively exploited in the wild or predicted to be highly exploitable. The workflow integrates fetching, enriching, and scoring vulnerabilities to generate an actionable remediation plan with defined SLAs.

A detailed guide for conducting professional disk forensics investigations, covering the entire lifecycle from evidence acquisition to artifact analysis. This includes establishing a strict chain of custody, performing bit-for-bit forensic imaging using write blockers, identifying file system structures (MFT, inodes), recovering deleted files, analyzing key artifacts (Prefetch, Amcache), and reconstructing precise timelines of activity for incident response cases.

An open-source tool based on the CIS Docker Benchmark. It systematically audits critical security aspects of Docker deployments, including host configuration, daemon settings, and container runtime. It generates a detailed compliance report (pass/fail/warn) to ensure best practices and security compliance in production environments.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

A comprehensive security auditing tool designed to assess a Kubernetes cluster's compliance posture against established CIS benchmarks. It performs deep checks on control plane components (API Server, etcd, Controller Manager), worker nodes, and Role-Based Access Control (RBAC). Use it for proactive security assessments, compliance validation, and hardening throughout the CI/CD lifecycle.