Skill UI

Build automated pipelines to respond to AWS GuardDuty findings. This solution uses EventBridge to detect high-severity threats and triggers a Lambda function. The function automatically quarantines compromised resources (e.g., EC2 instances), creates forensic EBS snapshots, and sends detailed notifications via SNS, drastically reducing Mean Time To Respond (MTTR). Ideal for proactive cloud security posture management.

This skill analyzes AWS IAM policies using boto3 and Cloudsplaining principles to detect potential privilege escalation paths in AWS accounts. It identifies overly permissive policies, dangerous permission combinations (such as combining role passing and resource creation), and violations of least-privilege principles. It is designed for security incident investigation, threat hunting, and validating overall cloud security posture.

This skill audits Azure Blob and ADLS storage accounts for critical security misconfigurations. It checks for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, and outdated TLS versions. Using the Python SDK, it generates a detailed, risk-scored report to enhance cloud security posture management and detect potential data exposure risks.

A comprehensive guide for deploying and operationalizing Amazon GuardDuty. It provides continuous, intelligent threat detection across core AWS services including S3, EKS, and EC2 runtime monitoring. Use this skill to investigate suspicious activity, detect compromised credentials, or build automated incident response playbooks using EventBridge and Lambda for proactive security.

This skill detects compromised cloud credentials by analyzing anomalous API activity, impossible travel patterns, and unauthorized access indicators across AWS, Azure, and GCP. It integrates findings from GuardDuty, Defender for Identity, and Security Command Center to provide comprehensive threat visibility and assist in incident response and scope assessment.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This guide provides a comprehensive framework for auditing Azure Storage accounts to detect critical security misconfigurations. It specifically checks for publicly accessible blob containers, insufficient encryption settings (e.g., missing infrastructure encryption), overly permissive network rules, and exposed SAS tokens. It is essential for compliance verification, responding to security alerts (like anonymous access), and establishing a robust security baseline when onboarding new cloud subscriptions.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

A comprehensive guide and workflow for detecting unauthorized data exfiltration from AWS S3 buckets. It details how to leverage multiple AWS services—including CloudTrail, GuardDuty, Amazon Macie, and Athena—to analyze access patterns, identify bulk downloads, and detect cross-account data transfers, ensuring robust cloud compliance and security monitoring.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.