Skill UI

Leverage Certificate Transparency (CT) logs via crt.sh and Certstream to proactively monitor for suspicious SSL/TLS certificates. This skill helps detect lookalike domains, unauthorized certificate issuance, and potential phishing infrastructure targeting your organization before attacks launch. Includes querying logic and threat intelligence integration.

A comprehensive guide to deploying Microsoft Sentinel as a cloud-native SIEM/SOAR solution. Covers multi-cloud data connector setup (AWS, Azure, GCP), writing advanced KQL queries for threat detection and hunting, and building automated response playbooks using Logic Apps. Ideal for establishing centralized SOCs in complex, multi-cloud environments.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This skill details techniques for exploiting PHP's type juggling vulnerabilities, primarily caused by loose (==) comparison operators. It demonstrates how attackers can bypass authentication mechanisms, defeat magic hash function verifications, and manipulate application logic through controlled type coercion when testing web applications. Ideal for authorized security penetration testing.

This skill covers the deployment and fine-tuning of Web Application Firewall (WAF) rules across major cloud platforms like AWS, Azure, and Cloudflare. It addresses critical security needs such as mitigating OWASP vulnerabilities (SQLi, XSS), managing bot traffic, implementing rate limiting, and ensuring compliance (e.g., PCI-DSS). The workflow guides users through deploying managed rule sets, creating custom rate-based logic, and minimizing false positives.

A comprehensive guide to deploying and configuring Wazuh SIEM/XDR for robust endpoint detection and response. This skill covers agent authentication and management via API, creating custom decoders and rules, querying security alerts, and validating rule logic using logtest functionality.

This skill provides a comprehensive framework for building an automated Service Level Agreement (SLA) breach alerting system for vulnerability remediation. It covers defining severity-based SLA policies (Critical, High, Medium, Low), structuring a database schema for tracking, implementing breach detection logic, and dispatching multi-channel escalation notifications (Email, Slack, PagerDuty). Essential for achieving compliance and improving overall security posture.

A comprehensive guide for Security Operations Center (SOC) analysts on reducing false positive alerts in SIEM systems. Techniques include systematic threshold tuning, refining correlation logic, implementing allowlisting, and enriching data with threat intelligence to combat alert fatigue and improve detection accuracy.

A comprehensive guide detailing the process of acquiring and analyzing data from smartphones and tablets. It covers best practices for device isolation, physical/logical acquisition using tools like Cellebrite UFED and open-source alternatives (ALEAPP, iLEAPP), and subsequent deep analysis of communications, call logs, and application artifacts for legal or corporate investigations.

A comprehensive tool designed for assessing the security posture of Programmable Logic Controller (PLC) firmware. It specializes in detecting critical vulnerabilities such as hardcoded credentials, undocumented debug interfaces, backdoor functions, and memory corruption flaws. The tool supports analyzing major industrial platforms (Siemens, Allen-Bradley) by performing static and dynamic analysis, and verifying firmware integrity against known-good baselines, adhering to standards like IEC 62443. Use only in authorized lab environments.

This tool builds comprehensive forensic super-timelines by using Plaso to correlate events across diverse sources. It aggregates data from file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. This capability is essential for complex digital forensic investigations requiring cross-source event correlation or detailed activity sequence reporting.