Skill UI

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

Automate security scanning for Infrastructure as Code (IaC) using best-in-class tools like Checkov and tfsec. This method analyzes Terraform, CloudFormation, and Kubernetes manifests to detect misconfigurations, enforce policy-based governance, and prevent common security vulnerabilities (e.g., public S3 buckets) before deployment. Essential for establishing secure CI/CD pipelines and meeting compliance standards.

This skill provides a comprehensive guide to implementing advanced memory protection mechanisms on Windows endpoints. It covers critical techniques like Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG). Use this when hardening systems against various memory corruption exploits, such as buffer overflows and ROP chains, to significantly boost overall security posture.

This guide details implementing microsegmentation using Akamai Guardicore Segmentation. It helps map application dependencies, visualize east-west traffic flows, and establish granular, least-privilege network policies across diverse environments (VMs, containers, bare metal, cloud). Essential for achieving zero-trust architecture and meeting compliance standards like PCI DSS or HIPAA by preventing lateral movement.

This skill guides the implementation of Mobile Application Management (MAM) policies, enabling robust data protection for corporate assets on both managed and unmanaged mobile devices (BYOD). It covers configuring app-level controls such as Data Loss Prevention (DLP), selective wiping, and containerization using platforms like Microsoft Intune and Azure AD. Use this when enforcing data separation between personal and work environments without requiring full device enrollment.

This guide details the deployment and configuration of Suricata as a high-performance, inline Intrusion Prevention System (IPS). It covers setting up NFQueue mode, writing custom detection rules, managing commercial and community rulesets (like Emerging Threats), and optimizing performance for active, real-time blocking of malicious network traffic. Essential for robust security architecture and compliance.

This skill guides the implementation of Gitleaks for robust secret scanning across development lifecycles. It covers setting up pre-commit hooks to prevent secrets from being committed, integrating scanning into CI/CD pipelines (like GitHub Actions), and writing custom regex rules to detect and remediate hardcoded credentials (API keys, passwords, tokens) in Git history, ensuring adherence to secure SDLC practices.

This skill guides the integration of gitleaks and trufflehog into CI/CD pipelines. It automates the detection of hardcoded secrets, such as API keys, passwords, and tokens, preventing their accidental deployment. By integrating scans as a mandatory pre-deployment gate, organizations enforce strong security policies and maintain compliance.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This skill guides the process of designing, implementing, and validating advanced security detection use cases for Security Information and Event Management (SIEM) platforms like Splunk, Elastic, and Microsoft Sentinel. It focuses on mapping organizational threat profiles to the MITRE ATT&CK framework to build formal, high-fidelity detection rules, thereby strengthening Security Operations Center (SOC) coverage and reducing blind spots.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.