Skill UI

Analyze Linux system logs (syslog, auth.log, kern.log, systemd journal, audit records, cron and application logs) to reconstruct user sessions, detect unauthorized access, and build event timelines for incident response and security assessments.

Guides security analysts through collecting, parsing, and correlating Windows, Linux, and web logs so they can reconstruct incident timelines, identify suspicious activity, and document evidence during forensic investigations.

Systematically map Windows and Linux persistence vectors to reveal how malware survives reboots, enumerating autoruns, services, scheduled tasks, and WMI entries during incident response and threat hunting.

Guide for acquiring and analyzing smartphone data with Cellebrite UFED plus ALEAPP/iLEAPP and libimobiledevice, covering device prep, logical/physical dumps, and messaging extraction for investigations.

Capture and analyze PCAP traffic with Wireshark/tshark to reconstruct suspicious sessions, extract artifacts, and detect malicious communications during incident response and malware investigations.

Use Wireshark, tshark, tcpdump, and Python tooling to inspect PCAP/PCAPNG data, reconstruct communications, surface malicious traffic, and support incident investigations with evidence of exfiltration or C2 activity.

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

Use steganalysis and metadata tools to detect concealed payloads inside images, audio, and video, guiding investigators through metadata review, automated scans, LSB statistics, and extraction attempts for covert channel detection.

Performs proactive threat hunting inside Elastic Security SIEM by crafting KQL/EQL hunting queries, translating findings into detection rules, and using Timelines to investigate anomalies that evade automated alerts.

Build forensic super-timelines with Plaso's log2timeline/psort suite, ingesting disk images and artifacts, applying parser or filter selections, and exporting to Timeline Explorer or Timesketch to correlate events across investigations.

Performs UEBA-driven anomaly detection in SIEM environments to flag impossible travel, privilege abuse, anomalous timing, and data access deviations so SOC teams can investigate compromised accounts or insider threats.

Guides SOC analysts through triaging Splunk ES notable events by prioritizing queues, investigating context, correlating telemetry, enriching with threat intelligence, and documenting disposition for escalation or closure.