Skill UI

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This skill facilitates the creation of real-time incident response dashboards across major SIEM platforms (Splunk, Elastic, Grafana). It provides SOC analysts and leadership with unified situational awareness by tracking affected systems, containment status, Indicators of Compromise (IOC) spread, and the entire incident response timeline, crucial for coordination and post-incident reporting.

This pipeline provides an automated solution for processing raw Indicators of Compromise (IOCs) from various sources, including IPs, domains, URLs, and emails. It performs crucial steps such as normalization, deduplication, and defanging (modifying indicators to prevent accidental execution while preserving readability). The final, processed data is converted into the standardized STIX 2.1 format and can be securely distributed via TAXII servers or MISP instances, streamlining threat intelligence sharing.

A comprehensive guide to building an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. This skill teaches how to leverage OpenCTI's native STIX 2.1 model and internal connectors to pull deep context from major external threat intelligence sources like VirusTotal, Shodan, AbuseIPDB, and GreyNoise. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and generates confidence scores for rapid analyst prioritization.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

A comprehensive guide to building automated Indicator of Compromise (IOC) enrichment pipelines within Splunk Enterprise Security. This process integrates multiple external threat feeds (STIX/TAXII, CSV, APIs) into normalized KV Store collections. By correlating these enriched threat indicators against live security events using advanced lookup searches, SOC teams can significantly reduce manual triage time and automatically identify potential security incidents.

A comprehensive system for systematically collecting, categorizing, and enriching Indicators of Compromise (IOCs) from various sources (network logs, memory dumps, email, etc.). It supports the entire incident response lifecycle, ensuring structured data representation using STIX/TAXII formats for robust threat intelligence sharing and defensive system automation.

This comprehensive skill guides the deployment and utilization of MISP, a powerful open-source threat intelligence platform. It covers configuring various threat feeds (TAXII, CSV, etc.) and using the PyMISP Python API to programmatically automate the collection, storage, and correlation of Indicators of Compromise (IOCs) and threat events from diverse community and commercial sources.

A comprehensive guide for collecting volatile forensic evidence from a compromised host while adhering to the order of volatility. This process captures critical data—including memory dumps, network connections, running processes, and system state—before the host is isolated or powered down. Essential for root cause analysis, fileless malware investigation, and maintaining a defensible chain of custody for legal proceedings.

This skill simulates Pass-the-Ticket (PtT) attacks, a critical post-exploitation technique. It involves dumping active Kerberos tickets (TGT/TGS) from memory (LSASS) on a compromised host and injecting them into another session. This allows an attacker to impersonate the ticket owner and perform lateral movement or escalate privileges without needing the user's password. Use exclusively for authorized red-teaming and security auditing.

Guides SOC teams through validating alerts, isolating networks and endpoints, preserving evidence, and disabling compromised accounts to rapidly contain an active breach while minimizing business impact.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.