Skill UI

Cartography syncs multi-cloud assets (AWS, GCP, Azure) into a Neo4j graph database. It maps relationships like IAM chains, network paths, and cross-account trusts, allowing security teams to conduct comprehensive asset inventories, identify complex attack paths, and generate detailed security reports across heterogeneous cloud environments.

A comprehensive guide for conducting cloud forensics investigations across AWS, Azure, and GCP. This workflow demonstrates how to preserve volatile and non-volatile evidence, including snapshotting volumes, capturing instance metadata, and collecting critical logs (CloudTrail, Activity Log, Audit Log) to trace unauthorized access and analyze security breaches.

Provides detailed, cloud-native procedures for containing security incidents across major platforms (AWS, Azure, GCP). The guide outlines how to revoke compromised IAM credentials, isolate resources using network security groups and ACLs, and preserve forensic evidence through snapshots and policy enforcement, minimizing lateral movement risk during an active breach.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

This guide outlines the process for forensically acquiring digital evidence from major cloud storage services, including Google Drive, OneDrive, Dropbox, and Box. The method combines API-based remote data extraction (such as audit logs and revision histories) with the collection of local endpoint sync-client artifacts. It is essential for conducting thorough incident response, security assessments, and e-discovery investigations involving cloud-synced data.

This skill provides a comprehensive framework for performing authorized penetration testing on Google Cloud Platform (GCP). It uses specialized tools like GCPBucketBrute to enumerate publicly accessible storage buckets and audits IAM policies to identify overly permissive role bindings. The process includes checking service account keys and mapping potential privilege escalation paths, generating actionable, risk-scored reports for robust cloud security posture management.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

This skill provides comprehensive functionality for integrating and interacting with Hardware Security Modules (HSMs) via the industry-standard PKCS#11 interface using python-pkcs11. It supports key generation, signing, encryption, and verification operations across various platforms, including SoftHSM2, AWS CloudHSM, and YubiHSM2. It is essential for implementing robust, tamper-resistant key management systems and validating compliance against standards like FIPS 140-2/3.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

This skill outlines the systematic process of integrating new data sources (e.g., Firewalls, EDR, Cloud, AD) into a SIEM platform. It covers planning, configuring collectors, building parsers, normalizing data fields (e.g., CIM), and validating data quality to enhance security monitoring and incident detection capabilities.

This process validates the necessity of elevated permissions across critical accounts, including domain admins, service accounts, and cloud IAM roles. It is a core identity governance function mandated by major compliance frameworks (SOX, PCI DSS) to enforce the principle of least privilege, detect stale or excessive access, and ensure continuous security compliance.

This tool automates the discovery and comprehensive inventory of all privileged accounts across an enterprise infrastructure. It identifies domain administrators, local accounts, service accounts, cloud IAM roles, and application admins. It supports risk classification, enabling organizations to build accurate inventories, onboard accounts to PAM solutions, and scope necessary privileged access controls for compliance and security assessments.