Skill UI

A comprehensive guide to deploying deception technologies, including honeypots, honeytokens, and decoy systems, within a Security Operations Center (SOC). This skill is used to detect advanced attackers who bypass perimeter defenses by monitoring lateral movement, credential abuse, and internal reconnaissance. It provides high-fidelity, near-zero false positive alerts and is essential for threat hunting and incident response strategy.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

This skill provides a systematic framework for managing Indicators of Compromise (IOCs) throughout their entire life cycle—from initial discovery and validation to enrichment, deployment, monitoring, and eventual retirement. It emphasizes implementing confidence decay functions, tracking hit rates, and managing false positives to maintain a high-quality, actionable threat intelligence database, thereby minimizing analyst fatigue and maximizing detection efficacy.

This tool guides the process of reviewing security findings from DAST and SAST scanners. It uses the OWASP risk rating methodology to classify vulnerabilities (true positive, false positive, needs review) and calculate a comprehensive risk score based on likelihood and impact, ensuring development teams prioritize the most critical issues.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

Guides teams through classifying and triaging declared security incidents, scoring severity, filtering false positives, routing escalations, and starting forensic collection consistent with NIST SP 800-61.

Analyzes Terraform plan JSON from the AzureRM provider to filter false-positive Set-type attribute diffs when reviewing changes to gateways, load balancers, NSGs, and similar resources.

This guide teaches targeted verification strategies for historical research. When initial searches suggest a candidate name or figure, do not continue with broad searches. Instead, immediately switch to verifying the candidate against all specific constraints (time period, location, family details, major events) using precise search queries to confirm identity and eliminate false positives.

This technique is designed for the final verification stage when analyzing a candidate TV series. Instead of accepting initial matches, users must perform targeted searches combining the show name and specific character details (e.g., birth year, specific plot event, relationship). This ensures that the candidate show satisfies all complex constraints, eliminating false positives and confirming the accuracy of the plot details.