Skill UI

Queries Azure Monitor activity and sign-in logs via azure-monitor-query to detect suspicious admin operations, impossible travel, privilege escalation, and resource modifications, enabling SOC analysts to run KQL threat-hunting workflows across tenants.

Detects anomalous authentication patterns by normalizing logs across Azure AD, Okta, and Windows AD, then applying UEBA analytics and ML baselines to highlight impossible travel, credential stuffing, brute-force, password spraying, and other compromised-account behaviors.

Detect compromised AWS, Azure, and GCP credentials by analyzing GuardDuty, Defender, and SCC insights along with logs to surface anomalous API use, impossible travel, and credential abuse indicators during investigations.

Analyzes Microsoft 365 audit, inbox rule, and sign-in data to spot compromised O365 or Google Workspace accounts, flagging forwarding rules, suspicious Microsoft Graph API usage, and impossible-travel signals for faster incident response.

Performs UEBA leveraging SIEM baselines and Splunk analytics to spot compromised accounts, privilege abuse, impossible travel, and insider risks by comparing current activity against historical user norms for SOC operations.