Skill UI

A comprehensive guide detailing the process of acquiring and analyzing data from smartphones and tablets. It covers best practices for device isolation, physical/logical acquisition using tools like Cellebrite UFED and open-source alternatives (ALEAPP, iLEAPP), and subsequent deep analysis of communications, call logs, and application artifacts for legal or corporate investigations.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

This skill performs deep forensic analysis on SQLite databases, going far beyond simple SQL queries. It is used in digital forensics and incident response to recover deleted records from freelist pages, analyze Write-Ahead Logs (WAL), and examine internal B-tree structures. It is essential for extracting critical evidence from mobile, browser, and application data sources.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

This tool builds comprehensive forensic super-timelines by using Plaso to correlate events across diverse sources. It aggregates data from file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. This capability is essential for complex digital forensic investigations requiring cross-source event correlation or detailed activity sequence reporting.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

Astro is a modern web framework designed specifically for building high-performance, content-heavy websites like blogs, documentation sites, and portfolios. Its core innovation is the Islands Architecture, which ships zero JavaScript by default, drastically improving performance and Core Web Vitals. It supports multi-framework components (React, Vue, Svelte) in a single project, making it ideal for content developers prioritizing speed and flexibility.

This guide details how to build an MCP app, which is an MCP server enhanced to serve interactive UI resources. It allows developers to render complex widgets—such as forms, pickers, dashboards, and confirmation dialogs—directly inline within a chat conversation. Learn about the architecture, host specifics, and when to use a widget versus standard text output.

This skill generates user-friendly, public-facing release notes (changelogs) for App Stores. It analyzes the raw Git history since the last tag, intelligently filtering out internal commits (like refactors, CI updates, or build scripts) and grouping visible changes into concise, benefit-focused bullet points suitable for a "What's New" section.