Skill UI

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.

Details the deployment, hardening, and operation of a resilient Command and Control (C2) infrastructure using the open-source Sliver framework. This guide covers advanced techniques including multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), deployable redirectors, and domain fronting, making it essential for authorized red-teaming and sophisticated adversary simulation.

Timesketch is a powerful, open-source tool for security teams to build collaborative forensic timelines. It ingests, normalizes, and analyzes multi-source event data—including logs, artifacts, and Plaso outputs—to reconstruct complex attack chains and document incident investigations. Ideal for joint analysis and deep dive DFIR work.

A comprehensive guide to building an automated Indicator of Compromise (IOC) enrichment pipeline using OpenCTI. This skill teaches how to leverage OpenCTI's native STIX 2.1 model and internal connectors to pull deep context from major external threat intelligence sources like VirusTotal, Shodan, AbuseIPDB, and GreyNoise. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and generates confidence scores for rapid analyst prioritization.

A comprehensive skill for building detailed threat actor profiles. It systematically collects and correlates intelligence from diverse open-source sources, including vendor reports, dark web forums, social media, and code repositories. The resulting structured dossiers map adversary motivations, capabilities, infrastructure, and Tactics, Techniques, and Procedures (TTPs), enabling robust attribution and defensive planning.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This skill details the architecture and deployment of a Threat Intelligence Platform (TIP). It covers integrating open-source CTI tools like MISP, OpenCTI, TheHive, and Cortex into a unified system. Users learn to set up feed ingestion pipelines, implement STIX/TAXII interoperability, and build analyst dashboards for comprehensive threat analysis and incident response.

DefectDojo is an open-source platform for comprehensive vulnerability management. It aggregates findings from over 200 security scanners (e.g., Nessus, ZAP), automatically deduplicates results, and provides detailed dashboards for tracking remediation progress. It integrates seamlessly with CI/CD pipelines, Jira for ticketing, and Slack for notifications, making it ideal for automated security reporting and compliance tracking in a DevSecOps environment.

This workflow guides SOC teams in establishing a comprehensive, structured process for vulnerability management. It utilizes major scanning tools (Nessus, Qualys, OpenVAS) to discover, prioritize, and track remediation of security weaknesses across the infrastructure. It integrates threat intelligence (CISA KEV) and asset criticality into risk scoring, ensuring resources are focused on the most critical threats.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This comprehensive skill guides the deployment and utilization of MISP, a powerful open-source threat intelligence platform. It covers configuring various threat feeds (TAXII, CSV, etc.) and using the PyMISP Python API to programmatically automate the collection, storage, and correlation of Indicators of Compromise (IOCs) and threat events from diverse community and commercial sources.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.