Skill UI

This solution enforces strict data contract validation for all APIs using OpenAPI Specification (OAS) and JSON Schema. It ensures that all incoming requests and outgoing responses conform to predefined structures. By implementing validation at both the API Gateway (runtime) and during development (shift-left), it effectively prevents critical security vulnerabilities such as SQL injection, XSS, unauthorized data leakage, and mass assignment.

This skill implements comprehensive API security testing using the 42Crunch platform. It combines static analysis (API Audit) on OpenAPI definitions, dynamic vulnerability scanning (API Conformance Scan) against running APIs, and runtime threat protection. Ideal for integrating OWASP API Security Top 10 checks into CI/CD pipelines and IDEs, enabling 'shift-left' security practices.

This guide details implementing comprehensive API security using Google Apigee. It covers multiple advanced policies, including JSON/XML content validation, regex injection detection (SQLi, XSS), rate limiting (SpikeArrest), and robust OAuth 2.0 enforcement. Use this when shielding critical APIs from OWASP API Top 10 threats and malicious client abuse patterns.

A comprehensive guide detailing how to implement Microsoft Defender for Cloud across various workloads (VMs, containers, SQL, storage) to achieve continuous security monitoring and compliance assessment. This process utilizes Azure Policy, Log Analytics, and Azure Arc for holistic protection, enabling adaptive remediation and meeting stringent regulatory requirements like PCI-DSS and CIS standards.

This skill covers the deployment and fine-tuning of Web Application Firewall (WAF) rules across major cloud platforms like AWS, Azure, and Cloudflare. It addresses critical security needs such as mitigating OWASP vulnerabilities (SQLi, XSS), managing bot traffic, implementing rate limiting, and ensuring compliance (e.g., PCI-DSS). The workflow guides users through deploying managed rule sets, creating custom rate-based logic, and minimizing false positives.

This utility implements comprehensive Cloud Workload Protection (CWPP) by monitoring compute workloads on cloud instances (EC2/GCE). It provides runtime security controls, detecting process anomalies, unauthorized binary execution, cryptomining activity, and suspicious network connections using AWS and Google APIs. Ideal for establishing robust security postures and meeting compliance requirements.

This guide details implementing robust code signing for various build artifacts, including binaries, packages, and containers. It covers both traditional GPG key-based signing and modern, keyless signing using Sigstore/cosign. Use this process to establish verifiable trust chains, ensure artifact integrity against supply-chain tampering, prove authenticity, and meet advanced security standards like SLSA.

A comprehensive guide to configuring multi-layered DDoS protection using Cloudflare. This skill covers mitigating volumetric (L3/4) and application-layer (L7) attacks by setting up managed rulesets, Web Application Firewall (WAF) rules, rate limiting, and Bot Management. Ideal for strengthening security architecture and meeting compliance standards.

This guide details the implementation of the three core email authentication protocols: SPF, DKIM, and DMARC. By configuring these DNS records, users can prevent domain spoofing, ensure message integrity, and define strict policies (quarantine/reject) for unauthenticated emails, drastically reducing exposure to phishing and spoofing attacks.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

This skill implements a simplified version of the Signal Protocol, focusing on robust end-to-end encryption (E2EE) for messaging applications. It covers critical cryptographic components including X3DH key agreement, the Double Ratchet algorithm for continuous key management, and AES-256-GCM for message encryption. The implementation ensures forward secrecy, meaning that compromising a current key does not reveal past messages. Use this when designing, building, or evaluating the security architecture of a messaging service to guarantee that only communicating parties can read the messages.