Skill UI

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

This guide details how to implement NextDNS as a zero-trust DNS filtering layer. By utilizing encrypted resolution (DoH/DoT) and real-time threat intelligence, it blocks malicious domains, prevents data exfiltration, filters ads/trackers, and enforces granular security policies across all endpoints, aligning with Zero Trust principles and enhancing overall network security.

This comprehensive guide details the implementation of Zero Trust Architecture (ZTA) in multi-cloud environments (AWS, Azure, GCP). Following NIST SP 800-207 and BeyondCorp principles, it covers identity-centric access controls, micro-segmentation, continuous verification, and deploying Identity-Aware Proxies (IAP) to eliminate implicit network trust.

A comprehensive guide to implementing Zero Trust Network Access (ZTNA) across major cloud platforms (AWS, Azure, GCP). This skill replaces traditional VPNs with identity-aware proxies, micro-segmentation, and conditional access policies. It ensures secure, context-aware access to cloud workloads, limiting lateral movement and adhering to BeyondCorp architectural principles.

This skill guides the end-to-end deployment of Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). It replaces traditional, perimeter-based VPNs by enforcing identity-based, context-aware microsegmentation. Learn to configure Identity Provider integration, deploy App Connectors, define granular application segments, and establish robust access policies for secure, outbound-only connections.

This skill guides the deployment of Google BeyondCorp Enterprise, enabling a true zero-trust security model. It utilizes Identity-Aware Proxy (IAP) and Access Context Manager (ACM) to authorize every request based on deep context, including user identity, device posture, and network attributes. It is essential for organizations moving away from traditional VPNs and needing robust, context-aware security controls for protecting GCP resources and internal applications.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This guide details how to simulate ARP spoofing attacks in controlled, authorized lab environments. It demonstrates Man-in-the-Middle (MITM) risks by poisoning the ARP cache, allowing users to test network detection capabilities (IDS/IPS, DAI) and validate the effectiveness of security controls like port security and 802.1X. This skill is strictly for authorized penetration testing and educational purposes.

This skill implements a multi-factor scoring model to assess the criticality of IT assets. By weighting factors such as business function impact, data sensitivity, regulatory scope, and network exposure, it assigns a risk tier. This tier is then used to dynamically adjust the Service Level Agreements (SLAs) for vulnerability remediation, ensuring that organizations prioritize patching efforts on their most critical 'crown jewel' systems first.

This guide details authenticated (credentialed) vulnerability scanning, which uses valid system credentials (SSH keys, domain passwords, etc.) to log into target hosts. Unlike external scanning, credentialed methods allow deep inspection of installed patches, local configurations, registry keys, and system files across diverse platforms (Linux, Windows, Network Devices). This significantly increases vulnerability detection rates and reduces false positives for comprehensive security assessments.

CAPE is an open-source sandbox built for automated malware analysis, derived from Cuckoo. It provides advanced behavioral monitoring, payload dumping, and configuration extraction using over 70 parsers for known malware families (e.g., Emotet, Cobalt Strike). It captures network IOCs, dropped files, and detects anti-evasion techniques, making it ideal for security assessments and incident response workflows via its robust API.