Skill UI

In-toto is a CNCF standard project used to verify the integrity of software supply chains. It generates cryptographically signed attestations (link metadata) at every stage of the CI/CD pipeline, proving exactly what artifacts were produced and who authorized the process. This is crucial for securing container builds and ensuring compliance against tampering.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

Implements a comprehensive incident ticketing system that connects SIEM alerts to major ITSM platforms like ServiceNow, Jira, or TheHive. This solution formalizes incident tracking, automates ticket creation, and manages critical processes such as Service Level Agreement (SLA) tracking, complex escalation workflows, and compliance documentation throughout the entire incident lifecycle.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

Automate comprehensive vulnerability management by deploying and operating Greenbone/OpenVAS. This skill guides the use of the python-gvm library to programmatically manage the entire scanning lifecycle: creating scan targets, executing complex vulnerability scans via the Greenbone Management Protocol (GMP), monitoring progress, and parsing detailed XML reports into actionable JSON findings. Ideal for security assessments and compliance checks.

This skill defines the process and framework for establishing mandatory Service Level Agreements (SLAs) for mitigating identified vulnerabilities. It guides users on how to calculate remediation timeframes based on vulnerability severity (CVSS, KEV), asset criticality (Tier 1, 2, 3), and exploit availability. The process includes setting up escalation chains, defining exception processes, and tracking key performance indicators (KPIs) like Mean Time to Remediate (MTTR) to ensure robust security governance and compliance.

This skill implements an automated system to monitor and alert on vulnerabilities that exceed their defined remediation Service Level Agreements (SLAs). It supports severity-based timelines, complex escalation workflows (e.g., PagerDuty, email), and generates comprehensive compliance reports, ensuring continuous adherence to security best practices.

This skill guides the end-to-end deployment of Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). It replaces traditional, perimeter-based VPNs by enforcing identity-based, context-aware microsegmentation. Learn to configure Identity Provider integration, deploy App Connectors, define granular application segments, and establish robust access policies for secure, outbound-only connections.

HashiCorp Boundary is an identity-aware proxy that establishes secure, zero-trust access to infrastructure resources, eliminating the need for traditional VPNs. It enforces a default-deny model and integrates with HashiCorp Vault to dynamically broker credentials. This ensures just-in-time, least-privilege access, automatic credential revocation, and comprehensive session recording for strict compliance and auditing.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

A comprehensive guide to building production-grade Laravel applications. It details architectural patterns for achieving scalability and maintainability, covering service/action separation, advanced Eloquent usage (casts, scopes), dependency injection via service containers, and robust API routing patterns.

This skill guides the end-to-end management of the Cyber Threat Intelligence (CTI) lifecycle. It covers defining Priority Intelligence Requirements (PIRs), planning data collection, processing data, performing multi-level analysis (Strategic, Operational, Tactical), disseminating tailored reports, and establishing continuous feedback loops to ensure intelligence relevance and maturity.