Skill UI

Performs endpoint digital forensics by capturing memory and disk images, analyzing artifacts, and rebuilding timelines to support incident investigations and legal evidence collection.

Use Foremost to carve files from forensic disk images and unallocated space, configuring headers, targeted scans, and optional Scalpel modes to extract documents, media, and evidence when metadata is missing.

Performs firmware image examination to uncover embedded malware, backdoors, or unauthorized modifications in routers, IoT units, UEFI/BIOS, and other embedded systems, covering extraction, filesystem inspection, reverse engineering, and bootkit hunting.

Use steganalysis and metadata tools to detect concealed payloads inside images, audio, and video, guiding investigators through metadata review, automated scans, LSB statistics, and extraction attempts for covert channel detection.

Build forensic super-timelines with Plaso's log2timeline/psort suite, ingesting disk images and artifacts, applying parser or filter selections, and exporting to Timeline Explorer or Timesketch to correlate events across investigations.

Use PhotoRec’s signature-based carving engine to recover deleted documents, images, videos, and databases from disk images or direct media when file systems are damaged or metadata is missing.

Use Anchore Grype to scan container images, archives, and SBOMs for known CVEs, enforce severity thresholds, and integrate results into CI/CD pipelines for consistent container security posture.

Integrates Aqua Security’s Trivy scanner into CI/CD workflows to automatically scan Docker images, IaC files, and configs for OS and dependency CVEs, enforce severity-based quality gates, and block vulnerable images before deployment.

Use Trivy to scan Docker and OCI images for OS/library CVEs, secrets, misconfigurations, licenses, and SBOM data; integrates with CI/CD pipelines and exports SARIF/JSON/CycloneDX for policy enforcement.

Defines workflows for scanning container registry images via Trivy and Grype, generating SBOMs, signing artifacts with Cosign/Sigstore, and configuring registry policies plus CI/CD gates to block unscanned or unsigned images.

This guide details the comprehensive process of securing a container registry using Harbor. Learn how to implement advanced security features such as integrated vulnerability scanning (Trivy), image signing (Cosign/Notary), Role-Based Access Control (RBAC), and content trust policies. The workflow covers deployment, policy enforcement, and integrating external authentication like OIDC, ensuring compliant and secure image provenance for Kubernetes environments.

Hardens managed EKS, AKS, and GKE clusters by enforcing Pod Security Standards, network policies, RBAC scoping, image admission controls, workload identity, and runtime monitoring for cloud-specific IAM integrations.