Skill UI

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

This skill guides the setup of Host-Based Intrusion Detection Systems (HIDS) using industry-standard tools like Wazuh, OSSEC, or AIDE. It covers essential security practices, including File Integrity Monitoring (FIM) for critical directories, monitoring system calls, detecting configuration changes, and identifying rootkits. It is crucial for meeting regulatory compliance requirements (e.g., PCI DSS) and significantly enhancing overall endpoint security posture.

Provides a comprehensive guide on installing, configuring, and tuning the Snort 3 Intrusion Detection System. This skill covers setting up network interfaces for promiscuous monitoring, writing custom rulesets, optimizing detection coverage, and integrating alerts with SIEM platforms to monitor network boundaries for malicious activity.

This skill deploys advanced anomaly detection systems for Operational Technology (OT) and Industrial Control Systems (ICS). It builds multi-dimensional baselines by analyzing SCADA communications, network traffic (Modbus, DNP3, OPC UA), and timing patterns. It detects deviations, rogue devices, and potential intrusions by profiling normal behavior, complementing signature-based IDS.

A specialized Intrusion Detection System (IDS) designed for Operational Technology (OT) and Industrial Control Systems (ICS). It monitors Modbus TCP/RTU traffic to detect unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines. Essential for securing SCADA environments against attacks like FrostyGoop.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

This skill guides the implementation of File Integrity Monitoring (FIM) using AIDE (Advanced Intrusion Detection Environment). It covers setting up AIDE configurations, creating initial baselines, performing scheduled integrity checks, and parsing detailed change reports. This is essential for maintaining strong security controls, meeting compliance requirements, and detecting unauthorized system modifications on Linux environments.

This skill guides the deployment of canary tokens and honeytokens across critical systems, such as fake AWS credentials, DNS records, and document beacons. These decoys are designed to trigger immediate alerts via webhooks when accessed by attackers, serving as a powerful early warning system for breach detection and intrusion detection.

Suricata is a high-performance, open-source network threat detection engine used for deep packet inspection. This skill details the deployment and configuration of Suricata in Intrusion Prevention System (IPS) mode. It covers setting up custom rules, integrating third-party rulesets (like Emerging Threats), and actively blocking malicious traffic in real time, making it essential for robust network security and compliance enforcement.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This guide demonstrates how to use the pycti Python client to model complex cyber threat intelligence within the OpenCTI platform. It structures threat actors, intrusion sets, campaigns, and TTPs into a unified STIX 2.1 knowledge graph. The skill is essential for correlating fragmented data from multiple sources (IOCs, reports) into a comprehensive, queryable adversary picture, supporting advanced threat hunting and detection engineering.