Skill UI

This guide details the deployment and configuration of Suricata as a high-performance, inline Intrusion Prevention System (IPS). It covers setting up NFQueue mode, writing custom detection rules, managing commercial and community rulesets (like Emerging Threats), and optimizing performance for active, real-time blocking of malicious network traffic. Essential for robust security architecture and compliance.

A guide and implementation pattern for deploying Nozomi Networks Guardian sensors. This solution enables passive, non-disruptive monitoring of Operational Technology (OT) and Industrial Control Systems (ICS). It provides critical asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment, making it essential for building robust OT Security Operations Centers (SOCs) and ensuring compliance without risking live operations.

This skill guides the integration of gitleaks and trufflehog into CI/CD pipelines. It automates the detection of hardcoded secrets, such as API keys, passwords, and tokens, preventing their accidental deployment. By integrating scans as a mandatory pre-deployment gate, organizations enforce strong security policies and maintain compliance.

This skill guides the implementation of security chaos engineering experiments. It involves deliberately degrading or disabling security controls (like WAF, firewalls, or log pipelines) in a controlled environment to rigorously verify the detection, alerting, and response capabilities of the Security Operations Center (SOC). Users learn to use tools like boto3 and Python to simulate failure scenarios and assess system resilience and compliance posture.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

This skill guides security teams on systematically tuning SIEM detection rules in platforms like Splunk and Elastic. It focuses on reducing alert fatigue and false positives by analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and measuring detection efficacy using metrics like precision and recall. This is crucial for maturing a Security Operations Center (SOC).

This skill guides the process of designing, implementing, and validating advanced security detection use cases for Security Information and Event Management (SIEM) platforms like Splunk, Elastic, and Microsoft Sentinel. It focuses on mapping organizational threat profiles to the MITRE ATT&CK framework to build formal, high-fidelity detection rules, thereby strengthening Security Operations Center (SOC) coverage and reducing blind spots.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

This skill provides a comprehensive framework for building an automated Service Level Agreement (SLA) breach alerting system for vulnerability remediation. It covers defining severity-based SLA policies (Critical, High, Medium, Low), structuring a database schema for tracking, implementing breach detection logic, and dispatching multi-channel escalation notifications (Email, Slack, PagerDuty). Essential for achieving compliance and improving overall security posture.

This guide details configuring ModSecurity WAF and OWASP Core Rule Set (CRS) for comprehensive web application security auditing. It covers essential steps such as initial deployment, rule tuning to minimize false positives, configuring detailed audit logging, and integrating logs into SIEM systems for robust threat detection.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

This skill maps observed adversary behaviors, security alerts, and detection rules to the MITRE ATT&CK framework. It is essential for quantifying detection coverage, building ATT&CK heatmaps, tagging SIEM alerts, and prioritizing security controls based on known threat actor playbooks. Use it for comprehensive gap analysis and risk reporting.