Skill UI

Guides an agent to critically review a written implementation plan, execute every outlined step with required verifications, and hand off completion via finishing-a-development-branch procedures, ensuring blockers prompt clarification.

This skill provides an in-depth legal analysis of real estate auctions in Brazil, covering both judicial (CPC) and extrajudicial (Law 9.514/97) procedures. It details critical steps like citation, attachment, auction stages, and highlights high-risk areas such as spousal notification and grounds for nullity, acting as an expert legal consultant.

This skill provides a systematic methodology for mapping real-world threat actor Tactics, Techniques, and Procedures (TTPs) to the globally recognized MITRE ATT&CK framework. Users learn how to leverage tools like ATT&CK Navigator and Python libraries (e.g., attackcti, stix2) to analyze security incidents, visualize technical coverage heatmaps, identify critical detection gaps, and generate actionable intelligence reports linking observed Indicators of Compromise (IOCs) to specific adversary techniques across various platforms (Enterprise, Mobile, ICS).

This tool helps security analysts map Advanced Persistent Threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. By utilizing the ATT&CK Navigator and the attackcti Python library, users can query STIX/TAXII data to visualize threat profiles, assess detection coverage gaps, and guide defensive planning for complex cyber incidents.

This tool assists in defining a structured Security Operations Center (SOC) escalation matrix. It maps incident response procedures based on severity (P1-P4), asset criticality, and business impact. Users can model tiered response paths, set Service Level Agreements (SLAs), and implement context-driven automatic escalation triggers to ensure rapid and consistent handling of cybersecurity incidents.

This framework provides a comprehensive solution for tracking vulnerability aging and measuring remediation performance against defined Service Level Agreements (SLAs). It helps organizations enforce severity-based timelines, calculate key performance indicators (KPIs) like Mean Time to Remediate (MTTR), and automate escalation procedures to ensure continuous compliance and improve overall security posture.

A structured guide for conducting blameless post-mortem reviews after any security incident. This process helps identify root causes using techniques like the 5 Whys, calculates critical metrics (MTTD, MTTR), and generates actionable recommendations to continuously improve incident response playbooks and procedures.

This skill provides structured procedures for detecting Golden Ticket attacks, a severe threat involving forging Kerberos Tickets in Active Directory. It analyzes Windows Event ID 4769 for indicators such as RC4 encryption downgrades, abnormal ticket lifetimes, and inconsistencies in TGS/TGT requests. Designed for SOC analysts and threat hunters using SIEM platforms (Splunk/Elastic) to enhance security monitoring coverage against credential theft.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

A comprehensive playbook designed for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It provides structured, phased incident response procedures aligned with SANS PICERL, IEC 62443, and NIST standards. It specifically addresses safety-critical challenges, process availability, and the unique coordination required between IT Security, OT Engineering, and Plant Operations during cyber incidents, such as ransomware attacks.

This skill guides the implementation of Security Orchestration, Automation, and Response (SOAR) workflows using platforms like Splunk Phantom. It automates the entire incident lifecycle, including alert triage, IOC enrichment (via VirusTotal, CrowdStrike), containment actions, and ticket creation (ServiceNow). Ideal for SOC teams needing to reduce Mean Time To Respond (MTTR) and standardize complex security procedures across multiple tools.