Skill UI

This skill outlines how to configure rsyslog for robust, centralized log collection. It covers establishing high-availability syslog infrastructure using TLS encryption, X.509 certificate authentication, and reliable disk-assisted queuing. Learn to generate and deploy both server and client configurations for secure, segregated, and reliable security operations logging.

Automate comprehensive vulnerability management by deploying and operating Greenbone/OpenVAS. This skill guides the use of the python-gvm library to programmatically manage the entire scanning lifecycle: creating scan targets, executing complex vulnerability scans via the Greenbone Management Protocol (GMP), monitoring progress, and parsing detailed XML reports into actionable JSON findings. Ideal for security assessments and compliance checks.

This guide details how to implement NextDNS as a zero-trust DNS filtering layer. By utilizing encrypted resolution (DoH/DoT) and real-time threat intelligence, it blocks malicious domains, prevents data exfiltration, filters ads/trackers, and enforces granular security policies across all endpoints, aligning with Zero Trust principles and enhancing overall network security.

This skill guides the deployment of Google BeyondCorp Enterprise, enabling a true zero-trust security model. It utilizes Identity-Aware Proxy (IAP) and Access Context Manager (ACM) to authorize every request based on deep context, including user identity, device posture, and network attributes. It is essential for organizations moving away from traditional VPNs and needing robust, context-aware security controls for protecting GCP resources and internal applications.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

BloodHound is an open-source reconnaissance tool that leverages graph theory to analyze Active Directory relationships. This guide details the process of collecting AD data using SharpHound and visualizing complex attack paths. It helps identify potential privilege escalation chains, trust abuses, and misconfigurations necessary for an attacker to move from a low-privilege user account to Domain Admin, making it essential for advanced red-teaming and security auditing.

This skill systematically enumerates and audits Active Directory forest trust relationships using advanced techniques like SID filtering analysis, detecting SID history abuse, and assessing inter-realm Kerberos ticket configurations. It is designed for red-teaming and security auditing to identify potential lateral movement paths and trust vulnerabilities across organizational boundaries.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This tool simulates advanced security testing to identify vulnerabilities in API rate limiting. It bypasses throttling controls by manipulating request headers (like X-Forwarded-For spoofing), varying source IP addresses, and manipulating endpoint paths. Essential for assessing API resilience against brute-force attacks, credential stuffing, and resource exhaustion, aligning with OWASP API Security guidelines.

CAPE is an open-source sandbox built for automated malware analysis, derived from Cuckoo. It provides advanced behavioral monitoring, payload dumping, and configuration extraction using over 70 parsers for known malware families (e.g., Emotet, Cobalt Strike). It captures network IOCs, dropped files, and detects anti-evasion techniques, making it ideal for security assessments and incident response workflows via its robust API.

This skill simulates various network attack scenarios, including bandwidth throttling, traffic shaping, and network degradation, using tools like tc, iperf3, and Scapy. It is designed for authorized security assessments to test the resilience of applications, validate Quality-of-Service (QoS) policies, and assess the ability of network monitoring tools to detect sophisticated traffic manipulation attacks (e.g., Slowloris-style attacks).