Skill UI

This skill automates the entire SSL/TLS certificate lifecycle, including generating Certificate Signing Requests (CSRs), issuing, deploying, monitoring, renewing, and revoking X.509 certificates. Using Python and the ACME protocol, it ensures continuous security by preventing outages caused by certificate expiry, making it vital for building robust, automated PKI and security workflows.

A comprehensive guide for Security Operations Center (SOC) teams to perform proactive threat hunting using Elastic SIEM. This skill teaches advanced techniques like KQL and EQL queries, analyzing event sequences, and investigating anomalies to uncover threats that bypass automated detection rules. Ideal for validating detection coverage gaps and responding to new TTPs based on the MITRE ATT&CK framework.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.

This tool builds comprehensive forensic super-timelines by using Plaso to correlate events across diverse sources. It aggregates data from file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. This capability is essential for complex digital forensic investigations requiring cross-source event correlation or detailed activity sequence reporting.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

A specialized tool for formalizing and verifying complex mathematical proofs, particularly in Machine Learning and AI theory. It guides users through structuring theorems, identifying explicit assumptions, performing feasibility triage, and ensuring every logical step is rigorously justified, preventing the fabrication of proofs.

A comprehensive guide for securing container registries by enforcing vulnerability scanning (Trivy, Grype), generating Software Bill of Materials (SBOM), and implementing digital signing using Cosign and Sigstore. This solution is essential for establishing robust CI/CD pipelines and preventing supply chain attacks before image promotion.

A comprehensive guide to hardening GitHub Actions CI/CD workflows against modern supply chain attacks, credential theft, and privilege escalation. Learn techniques such as pinning actions to immutable SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection from untrusted inputs, and implementing required review gates for secure deployment pipelines. Essential for any project handling production secrets or elevated permissions.

This skill provides a comprehensive audit framework for securing process historian servers (e.g., OSIsoft PI, Honeywell PHD) within industrial Operational Technology (OT) environments. It guides users through assessing network exposure, implementing Purdue Model segmentation, and establishing secure data replication through a DMZ, ensuring process data integrity and preventing unauthorized access.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

A structured framework for performing initial security incident triage. It guides analysts through classifying incident types using established standards like NIST SP 800-61r3, assigning business impact severity (P1-P4), enriching alerts with threat intelligence, and determining containment and escalation paths. Use when SIEM/EDR alerts require human judgment or when coordinating multiple concurrent security events.

This skill helps developers structure and record critical architectural decisions (ADRs) made during coding sessions. It automatically detects moments of decision, capturing the context, alternatives considered, and the rationale (trade-offs and consequences). This maintains a living log that explains 'why' the code base was built the way it is, preventing knowledge loss and improving project maintainability.