Skill UI

Provides architecture guidance for Istio/Linkerd-based service meshes, covering traffic management, security policies, observability, and multi-cluster networking to stabilize cloud-native microservices.

Use Wireshark to capture and filter live traffic or PCAP files, inspect protocols, follow streams, and generate statistics for incident response, performance tuning, and protocol learning.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

SimPy is a powerful, process-based discrete-event simulation framework written in Python. It is designed for modeling complex systems where entities interact with shared resources and time-based events occur, such as manufacturing lines, service queues, network traffic, or logistics networks. Use this skill to analyze resource contention, simulate process optimization, conduct capacity planning, and model dynamic system behaviors.

Runs suspect binaries through Cuckoo Sandbox to capture process creation, file drops, registry edits, network traffic, and API calls, producing detailed behavior reports and IOCs for controlled malware investigations.

Parses NetFlow v9/IPFIX via the Python netflow library to build traffic baselines and flag volumetric anomalies, port scans, exfiltration, and C2 beacons during SOC hunts.

Examines packet captures, Zeek logs, and NetFlow data to uncover C2 channels, lateral movement, and exfiltration during security incidents, guiding analysts through capture, filtering, and IOC extraction workflows.

Analyzes malware-generated network traffic using Wireshark, Zeek, Suricata, and Python scripts to uncover C2 protocols, data exfiltration, DNS tunneling, HTTP/HTTPS payloads, and beaconing patterns during sandbox or live incident-response investigations.

Use Wireshark and tshark to capture authorized packets, dissect protocols, highlight malicious traffic patterns, and extract artifacts for incident response, threat hunting, or performance troubleshooting.

Step-by-step instructions to install Snort 3, tune network interfaces, configure Lua-based detection rules, and integrate rule management so you can monitor segmented traffic for malicious activity and feed alerts to SIEM tools.

Deploys machine-learning anomaly detection for OT environments by modeling SCADA polling behaviors, profiling Modbus/DNP3/OPC UA traffic, and correlating network anomalies with historian process data to spot rogue devices and unusual process deviations.