Skill UI

This skill guides the implementation of continuous, risk-adaptive identity verification crucial for Zero Trust Architecture (ZTA). It covers deploying phishing-resistant MFA (FIDO2/WebAuthn), advanced risk-based conditional access policies, and identity governance strategies. Users learn how to move beyond traditional credentials by leveraging multiple signals—such as device posture, behavioral biometrics, and location context—to dynamically assess and enforce trust levels before granting access.

This skill details implementing a ransomware-resistant, immutable backup strategy using the restic tool. It leverages S3-compatible Object Lock (Compliance Mode) to ensure Write Once Read Many (WORM) storage, preventing deletion or modification by attackers. The process includes automated backup, cryptographic integrity verification (restic check), and scheduled restore testing, adhering to advanced security standards like 3-2-1-1-0.

This methodology provides SOC teams with an adversary-centric framework to evaluate security detection capabilities against the MITRE ATT&CK framework. By systematically mapping existing SIEM rules and data sources, users can identify critical detection gaps, prioritize rule development efforts, and measure the overall maturity of their security operations center (SOC) defenses over time.

This skill details the deployment and advanced querying techniques for Arkime (Moloch), enabling comprehensive full packet capture network traffic analysis. Users can leverage the Arkime API v3 to search connections, download PCAPs, detect sophisticated C2 beaconing, and analyze connection patterns and anomalies across DNS, HTTP, and TLS traffic. Essential for security monitoring and network forensics.

This skill guides the implementation of network traffic baselining using historical NetFlow/IPFIX data. It leverages Python's pandas library to compute detailed statistical profiles, including hourly/daily distributions, per-host metrics, and protocol ratios. Anomalies are robustly detected using z-score and Interquartile Range (IQR) methods, assisting SOC analysts in identifying unusual activities like data exfiltration or beaconing.

This guide details the implementation of a robust, ransomware-resilient backup architecture following the extended 3-2-1-1-0 rule. It covers critical steps such as classifying assets, defining RPO/RTO, implementing immutable or air-gapped storage, and isolating backup credentials from the production domain. Use this knowledge to design a multilayered defense against data loss and ensure reliable recovery points.

This skill covers the comprehensive management of RSA key pairs, including generation, secure storage, rotation, and validation. It adheres to NIST guidelines, covering key serialization formats (PEM, DER, PKCS#8), passphrase protection, and ensuring robust key strength for digital signatures and encryption.

Tetragon, a CNCF project under Cilium, provides advanced, kernel-level runtime security observability and policy enforcement in Kubernetes clusters. By utilizing eBPF, it monitors process execution, file access, and network connections with minimal overhead, enabling detection and prevention of container escapes, unauthorized access, and suspicious activity.

This skill guides the process of designing, implementing, and validating advanced security detection use cases for Security Information and Event Management (SIEM) platforms like Splunk, Elastic, and Microsoft Sentinel. It focuses on mapping organizational threat profiles to the MITRE ATT&CK framework to build formal, high-fidelity detection rules, thereby strengthening Security Operations Center (SOC) coverage and reducing blind spots.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This guide details the implementation of Zero Trust Architecture for securing Software as a Service (SaaS) applications. It leverages Conditional Access Policies, CASB (Cloud Access Security Broker), and Identity Governance to enforce strict identity verification, device compliance, and data loss prevention (DLP) across cloud environments (e.g., M365, Salesforce). It helps mitigate risks associated with shadow IT and excessive application permissions.

This guide provides a comprehensive workflow for Test-Driven Development (TDD) within Laravel applications. It covers best practices for writing unit, feature, and integration tests using modern tools like Pest and PHPUnit. Learn how to manage database states, mock external services, and achieve high code coverage efficiently.