Skill UI

Analyzes ModSecurity, AWS WAF, and Cloudflare logs to detect SQL injection campaigns, classify OWASP injection types, cluster attacker IPs, and generate incident-ready reports with attack success estimates.

Structures completed intrusion investigations with the Diamond Model by documenting adversaries, capabilities, infrastructure, and victims plus their relationships, metadata, and pivots to cluster incidents and support campaign attribution, confidence scoring, and analytic write-ups.

Runs authorized phishing simulation campaigns that design realistic pretexts, send targeted GoPhish emails, and track opens, clicks, and credential reports to measure organizational security awareness and resilience.

Hunt for spearphishing indicators across email logs, endpoint telemetry, and network data to detect targeted campaigns, validate intelligence, and update detections with actionable findings for containment.

Track trojanized updates, compromised dependencies, unauthorized code edits, and tampered build artifacts by querying EDR/SIEM telemetry, correlating indicators, and documenting findings for rapid response in proactive threat-hunting campaigns.

Deploy SailPoint IdentityNow or IdentityIQ to automate identity lifecycle management, access requests, certification campaigns, role mining, and SoD enforcement while generating compliance-ready reporting for enterprise IAM environments.

Guide for building STIX 2.1 objects and publishing them via TAXII 2.1 using the stix2 Python library, covering indicators, malware, campaigns, relationships, bundles, and downstream SIEM/SOAR sharing.

Configure and execute Saviynt Enterprise Identity Cloud access recertification campaigns to validate user entitlements, revoke excessive privileges, and satisfy SOX/SOC2/HIPAA compliance through scheduled, event-driven, or on-demand reviews enriched with risk scoring and analytics.

Conduct structured access reviews and certifications—defining campaign scope, selecting reviewers, prioritizing risks, and tracking remediation—to prove compliance during audits and governance-focused assessments.

Automates entitlement review, certification campaigns, and remediation workflows with SailPoint IdentityIQ to validate access, target sensitive applications, enforce SoD policies, and provide evidence for periodic compliance campaigns such as SOX or HIPAA.

Performs coverage-guided fuzzing on compiled binaries using the AFL++ toolchain, automating instrumentation, corpus minimization, parallel campaigns, and crash triage to uncover memory corruption and security flaws during assessments.

GoPhish is an open-source framework designed for security teams to conduct authorized phishing awareness campaigns. This skill guides users through the entire process: deploying GoPhish, setting up realistic phishing scenarios (templates, landing pages), executing the campaign, and analyzing results to measure and improve organizational resilience against social engineering attacks. It is crucial for proactive security testing and incident response validation.