Skill UI

Learn how to build and share structured threat intelligence objects, including indicators, malware, and campaigns, using the stix2 Python library. This guide details publishing data via the TAXII 2.1 protocol, making it essential for developing threat intelligence platforms, automating IOC exchange, and creating machine-readable reports for ISAC/ISAO communities.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This skill provides a comprehensive guide on integrating Cyber Threat Intelligence (CTI) feeds using STIX 2.1 and TAXII 2.1 standards. It demonstrates how to build both consumer and producer capabilities in Python, covering server discovery, polling collections, and parsing complex STIX objects (Indicators, Malware, Threat Actors). Ideal for professionals building SIEM/TIP integrations or advanced security architectures.

Learn how to deploy and configure a TAXII 2.1 server using OpenTAXII and Medallion. This guide covers publishing STIX 2.1 bundles, managing collections for various threat feeds, and integrating the resulting data stream with SIEM/SOAR platforms to automate the exchange of cyber indicators between organizations.

This skill provides SOC teams with a structured, multi-source workflow to investigate potential insider threats. It correlates data from SIEM, DLP, EDR, and HR feeds to detect data exfiltration attempts (via cloud, USB, email), unauthorized access patterns, and policy violations. It is crucial for building comprehensive investigation timelines, especially when handling departing employees or suspected data theft.

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

A comprehensive guide to detecting and mitigating advanced Adversary-in-the-Middle (AiTM) phishing attacks, which bypass Multi-Factor Authentication (MFA) using reverse proxies (e.g., Evilginx, EvilProxy). Learn defensive strategies including implementing FIDO2, configuring Conditional Access policies, and monitoring session hijacking indicators in SIEM/Web Proxies.

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.

This skill guides the systematic management of Indicators of Compromise (IOCs). It covers the entire lifecycle, from initial discovery and validation through enrichment (e.g., VirusTotal, Shodan) and deployment to SIEM/IDS. Key features include confidence decay over time, false positive tracking, and automated retirement policies, ensuring the threat intelligence database remains high-quality and actionable.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill leverages the VirusTotal API v3 to enrich file hashes (MD5, SHA-256). It retrieves comprehensive security data, including multi-engine detection rates, sandbox behavioral reports, YARA rule matches, and related Indicators of Compromise (IOCs). It is essential for SOC triage, incident response, and threat intelligence workflows.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.