Skill UI

This skill provides a comprehensive guide to implementing observability for MaintainX API integrations. It covers best practices for structured logging, Prometheus metrics collection (Counters, Histograms, Gauges), API request tracing using Axios interceptors, and setting up health and alerting endpoints. Use this when you need to monitor API reliability, detect performance degradation, and ensure rapid issue detection in your connected services.

A systematic, multi-language performance profiling suite designed for Node.js, Python, and Go applications. It identifies deep bottlenecks across CPU usage, memory leaks, and I/O constraints. Features include generating flamegraphs, analyzing bundle size dependency trees, optimizing database queries (N+1 detection), and running realistic load tests using k6 and Artillery. Ideal for establishing performance baselines, debugging slow endpoints, and ensuring scalability before deployment.

Guides configuring host-based intrusion detection (HIDS) with Wazuh/OSSEC/AIDE, covering agent installs, file integrity monitoring, rootkit checks, log rules, and active responses so endpoints stay compliant and feed SIEMs.

Guides deploying and configuring CrowdStrike Falcon EDR sensors across Windows, macOS, and Linux endpoints, covering policy tuning, response workflows, and SIEM integrations for onboarding, automated detection, and troubleshooting.

Detect defense-evasion techniques in endpoint logs by identifying log tampering, timestomping, process injection, security-tool disabling, and masquerading; use in threat hunting, detection engineering, or investigations that query telemetry from Sysmon, SIEM, or EDR.

Guides enabling PowerShell, Sysmon, and AMSI telemetry plus crafting detection hunts that catch fileless malware, reflective DLL injections, WMI persistence, and registry-based execution techniques operating entirely in memory.

Analyzes endpoint and cloud logs with pandas baselines and DLP policy violation context to expose insider exfiltration signs such as anomalous uploads, off-hours access, and device spikes during threat investigations.

Detects undocumented API endpoints by comparing traffic logs with OpenAPI specs, sweeping codebases, and using discovery tools so teams can inventory shadow APIs, validate monitoring rules, and shore up attack surface controls.

Detects command-and-control beaconing in network telemetry via frequency/jitter analysis, reputation checks, and endpoint context so hunters can spotlight compromised hosts and guide response workflows.

Hunt for spearphishing indicators across email logs, endpoint telemetry, and network data to detect targeted campaigns, validate intelligence, and update detections with actionable findings for containment.

Deploy and configure Wazuh SIEM/XDR to detect endpoints, manage agents, author custom decoders/rules, query alerts via REST, and validate automated responses with logtest for security posture checks.

Detects lateral movement such as Pass-the-Hash, PsExec, WMI, RDP, and SMB spreading by correlating Windows logs, NetFlow/Zeek data, and endpoint telemetry mapped to ATT&CK TA0008, supporting SOC investigations and detection engineering.