Skill UI

This skill provides a comprehensive guide to deploying Zeek (formerly Bro) for passive network security monitoring. It details how to generate structured logs (DNS, HTTP, SSL, etc.) and write custom Zeek scripts to detect sophisticated anomalies like DNS tunneling and beaconing. Ideal for threat hunting, security incident response, and complementing traditional IDS solutions.

This tool provides comprehensive asset discovery and inventory management for Operational Technology (OT) and Industrial Control Systems (ICS) environments using the Claroty xDome platform. It utilizes passive monitoring and active querying to achieve full visibility into critical assets across Purdue Model levels, including PLCs, RTUs, and HMIs. Ideal for compliance assessments (e.g., IEC 62443) and onboarding brownfield sites.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

This skill provides comprehensive functionality for monitoring and mapping adversary-controlled assets, such as C2 servers, phishing domains, and exploit kit hosts. By leveraging tools like Passive DNS, Certificate Transparency logs, and specialized scanners (Shodan/Censys), analysts can discover, track, and pivot through complex threat actor infrastructure over time, significantly enhancing security operations and threat intelligence maturity.