Skill UI

This guide details how to implement Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. PSS defines three mandatory security levels—Privileged, Baseline, and Restricted—for container workloads. It is essential for enhancing security posture, ensuring compliance, and migrating away from deprecated PodSecurityPolicy (PSP) controls by applying namespace labels and defining compliant pod specifications.

This skill guides the design and implementation of robust network segmentation using firewall zones, VLANs, ACLs, and microsegmentation. Learn to build secure, isolated zones (like DMZ, PCI CDE, Management) to enforce least-privilege access, restrict lateral movement, and meet stringent compliance requirements (PCI DSS, HIPAA).

Pod Security Admission (PSA) is a built-in Kubernetes admission controller designed to enforce Pod Security Standards (Baseline, Restricted, Privileged) at the namespace level. It serves as a crucial replacement for the deprecated PodSecurityPolicy (PSP), allowing users to implement robust security controls and maintain compliance. By applying specific labels, administrators can set enforcement modes (enforce, audit, warn) to harden container environments against unauthorized privilege escalation and security risks.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This skill provides a comprehensive guide to implementing robust USB device control policies. It restricts unauthorized removable media access to mitigate data exfiltration risks and prevent malware introduction via USB endpoints. Learn how to deploy granular policies using Group Policy Objects (GPO), Microsoft Intune, or advanced Endpoint Detection and Response (EDR) platforms to meet strict compliance standards.

This skill systematically enumerates and audits Active Directory forest trust relationships using advanced techniques like SID filtering analysis, detecting SID history abuse, and assessing inter-realm Kerberos ticket configurations. It is designed for red-teaming and security auditing to identify potential lateral movement paths and trust vulnerabilities across organizational boundaries.

Use RESTler to automate stateful security testing of REST APIs. It processes OpenAPI specifications to generate fuzzing grammars, allowing users to discover complex bugs, such as injection vulnerabilities, resource leaks, and unhandled exceptions (500 errors), by executing diverse sequences of API calls. Essential for robust CI/CD regression testing and proactive API security assessments.

A comprehensive guide to executing cloud-native incident containment procedures across major platforms including AWS, Azure, and GCP. Learn how to systematically isolate compromised resources, revoke malicious credentials, apply network restrictions (Security Groups/ACLs), and capture forensic evidence to prevent lateral movement during a security event. Essential for security assessments and incident response.

This guide provides a comprehensive methodology for assessing the security posture of Kubernetes etcd clusters. It covers critical areas including encryption at rest (for secrets), TLS transport security, access control validation, secure backup procedures, and network isolation checks, ensuring cluster data integrity and confidentiality.

This skill utilizes the SpiderFoot REST API and CLI to automate Open-Source Intelligence (OSINT) collection. It performs comprehensive target profiling, reconnaissance, and attack surface mapping across 200+ data sources. Users can select specialized modules (e.g., footprint, investigate) to analyze domains, IPs, and credentials, generating structured intelligence reports essential for security assessments, incident response, and threat intelligence gathering.

Provides a structured, comprehensive playbook for managing high-impact ransomware incidents. It guides the response team through initial detection, immediate network containment, detailed damage assessment, recovery decision making (including legal and financial considerations), and secure system restoration. Essential for cybersecurity teams facing active encryption attacks.

A comprehensive, NIST/CISA-aligned workflow for structured recovery following a ransomware incident. It covers critical steps including environment isolation, forensic evidence preservation, Active Directory restoration (DSRM, krbtgt reset), backup integrity validation, and phased, dependency-based system rebuild. Essential for post-incident disaster recovery planning.