Skill UI

Guides SOC teams through structured SIEM detection use cases on Splunk, Elastic, and Sentinel, spanning coverage-gap assessment, templated documentation, platform-specific correlation rules, and simulation-based validation tied to MITRE ATT&CK.

Build a PyMISP-driven threat intelligence platform that ingests multiple IOC feeds, tags MITRE ATT&CK techniques, enriches data via VirusTotal and AbuseIPDB, and exports STIX 2.1 bundles for SIEM pipelines.

Orchestrates MITRE ATT&CK-based threat modeling so SOC teams can map adversary TTPs, assess detection gaps, and prioritize defenses or procurement decisions with context-aware intelligence.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques to quantify detection coverage, expose blind spots, and guide control prioritization when building Navigator layers, tagging Sigma rules, aligning defenses to threat playbooks, or reporting risk.

Detects lateral movement techniques such as Pass-the-Hash, PsExec, WMI, RDP, and SMB pivots through SIEM correlation of Windows event logs, network flows, and endpoint telemetry aligned with MITRE ATT&CK TA0008 for SOC response and investigation.

Coordinates purple team exercises by pairing MITRE ATT&CK mapped adversary emulation with real-time SIEM monitoring so SOC analysts can validate detections and close gaps collaboratively.

Uses atomic-operator to execute Atomic Red Team tests and validate MITRE ATT&CK detection coverage, ideal for exercising SIEM/EDR safeguards and documenting detection gaps during purple team assessments.