Skill UI

This comprehensive guide details how to establish AWS Security Hub as a centralized Cloud Security Posture Management (CSPM) platform. It aggregates security findings from multiple AWS services (GuardDuty, Inspector, Macie) and third-party tools. Users can enforce compliance against industry standards (CIS, PCI-DSS, NIST), automate remediation workflows via EventBridge, and generate comprehensive evidence for compliance audits.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

A comprehensive guide for conducting cloud forensics investigations across AWS, Azure, and GCP. This workflow demonstrates how to preserve volatile and non-volatile evidence, including snapshotting volumes, capturing instance metadata, and collecting critical logs (CloudTrail, Activity Log, Audit Log) to trace unauthorized access and analyze security breaches.

Provides detailed, cloud-native procedures for containing security incidents across major platforms (AWS, Azure, GCP). The guide outlines how to revoke compromised IAM credentials, isolate resources using network security groups and ACLs, and preserve forensic evidence through snapshots and policy enforcement, minimizing lateral movement risk during an active breach.

This guide outlines the process for forensically acquiring digital evidence from major cloud storage services, including Google Drive, OneDrive, Dropbox, and Box. The method combines API-based remote data extraction (such as audit logs and revision histories) with the collection of local endpoint sync-client artifacts. It is essential for conducting thorough incident response, security assessments, and e-discovery investigations involving cloud-synced data.

This skill provides a comprehensive framework for vulnerability prioritization by combining three crucial data points: CISA's Known Exploited Vulnerabilities (KEV) catalog (confirming real-world exploitation evidence), EPSS scores (predicting exploitation probability), and CVSS metrics (assessing intrinsic severity). It builds a multi-factor prioritization engine to determine the most critical CVEs for immediate remediation, assisting security teams in managing large vulnerability backlogs efficiently.

A comprehensive guide for conducting deep disk forensics investigations. This method covers secure evidence acquisition, creating bit-for-bit forensic images, analyzing file system structures (MFT, inodes), recovering deleted files, and reconstructing timelines using industry-standard tools like Autopsy, FTK Imager, and The Sleuth Kit. Essential for legal, HR, and security incident response.

This skill guides comprehensive digital forensics investigations on compromised endpoints. It covers evidence collection (memory acquisition, disk imaging) and deep artifact analysis, including volatile data, MFT records, and prefetch files. Use it for incident response, legal evidence collection, and determining the scope of a breach by reconstructing attacker timelines.

This guide details the process of file carving using the Foremost tool in digital forensics. It demonstrates how to recover deleted or fragmented evidence (such as documents, images, and archives) from raw disk images or unallocated space by analyzing file headers and footers, independent of the file system's index. It also covers advanced techniques using custom signatures and high-performance alternatives like Scalpel.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

A specialized tool for performing comprehensive CIS Kubernetes Benchmark audits. It verifies the security configurations of control planes, worker nodes, and etcd against industry best practices. The output is designed to generate actionable compliance evidence for audits like SOC 2 or PCI DSS, helping users identify vulnerabilities, determine non-applicability on managed clusters (EKS, GKE, AKS), and plan remediation strategies.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.