Skill UI

Performs UEBA-based detection of impossible travel, unusual access, and privilege abuse so SOC teams can flag compromised accounts or insider threats by comparing recent behavior to SIEM baselines and statistical norms.

Automates ingestion of STIX 2.1 bundles from TAXII 2.1 servers, validates object schemas, maps indicators to downstream TIP/SIEM platforms, and optionally publishes vetted intelligence for collaborative sharing.

Guides SOC analysts through initial triage of SIEM/EDR alerts using NIST SP 800-61r3 and SANS PICERL, classifying incidents, assessing severity via impact matrices, enriching with threat and asset context, and escalating to the right response team with containment steps.