Skill UI

Use Falco YAML rules and the Falco gRPC API to monitor syscalls and runtime behavior in containers or Kubernetes, catching shell spawns, file tampering, network anomalies, and privilege escalation while parsing alerts to support incident response and security testing.

Uses the Kubernetes Python client to inspect pod security contexts, privileged mode, capabilities, namespace sharing, and hostPath mounts to highlight container escape vectors during security audits or incident response.

Uses Aqua Security Trivy to scan container images, filesystems, IaC, and Kubernetes manifests for vulnerabilities, secrets, and license issues while generating SBOMs and integrating into CI/CD pipelines for triage-ready reports.

Use kube-bench to audit Kubernetes clusters against CIS benchmarks, covering control plane, etcd, nodes, and RBAC with automated reports and CI/CD integration.

Guides operators through auditing etcd encryption, TLS transport, access controls, backup protection, and network isolation in Kubernetes clusters so secrets stay shielded even if the control plane is targeted.

Guides security teams through hands-on Kubernetes penetration testing—covering reconnaissance, KPI scanning (kube-hunter, Kubescape, kube-bench), RBAC exploitation, secret extraction, and compliance checks to validate cluster resilience.

Use Kubesec to analyze Kubernetes YAML/JSON manifests for misconfigurations, privilege escalation risks, and missing controls, delivering scores and remediation hints via CLI, Docker, kubectl plugin, or REST API for DevSecOps and CI/CD pipelines.

This guide details the comprehensive process of securing a container registry using Harbor. Learn how to implement advanced security features such as integrated vulnerability scanning (Trivy), image signing (Cosign/Notary), Role-Based Access Control (RBAC), and content trust policies. The workflow covers deployment, policy enforcement, and integrating external authentication like OIDC, ensuring compliant and secure image provenance for Kubernetes environments.

Validates Helm chart provenance, scans rendered templates for misconfigurations, enforces pod security contexts, and hardens RBAC/secrets workflows so Kubernetes deployments stay compliant.

Hardens managed EKS, AKS, and GKE clusters by enforcing Pod Security Standards, network policies, RBAC scoping, image admission controls, workload identity, and runtime monitoring for cloud-specific IAM integrations.

AegisOps-AI integrates Gemini 3 Flash to autonomously review Linux kernel patches, Terraform plans, and Kubernetes manifests, enforcing security, cost, and compliance guardrails inside the SDLC pipeline.

Deploys Cilium Tetragon-based eBPF tracing to watch processes, network, file access, and enforce runtime policies while streaming JSON events to SIEM pipelines for Linux hosts or Kubernetes clusters.