Skill UI

This comprehensive guide provides best practices for hardening container images, dramatically minimizing the attack surface in production environments. It covers advanced techniques such as implementing multi-stage builds, using distroless images, running containers as non-root users, and configuring read-only filesystems. Adherence to CIS Docker Benchmark and secure DevSecOps practices are key focuses.

This skill guides users through advanced container security practices using Trivy. It covers vulnerability scanning for container images, filesystems, IaC (Terraform, K8s), and Git repositories. Key features include generating industry-standard SBOMs (CycloneDX/SPDX), integrating scanning into CI/CD pipelines, and deploying the Kubernetes Operator for comprehensive supply chain security and compliance auditing.

A comprehensive guide to deploying deception technologies, including honeypots, honeytokens, and decoy systems, within a Security Operations Center (SOC). This skill is used to detect advanced attackers who bypass perimeter defenses by monitoring lateral movement, credential abuse, and internal reconnaissance. It provides high-fidelity, near-zero false positive alerts and is essential for threat hunting and incident response strategy.

A comprehensive guide for Security Operations Center (SOC) analysts on reducing false positive alerts in SIEM systems. Techniques include systematic threshold tuning, refining correlation logic, implementing allowlisting, and enriching data with threat intelligence to combat alert fatigue and improve detection accuracy.

This skill provides comprehensive functionality for integrating and interacting with Hardware Security Modules (HSMs) via the industry-standard PKCS#11 interface using python-pkcs11. It supports key generation, signing, encryption, and verification operations across various platforms, including SoftHSM2, AWS CloudHSM, and YubiHSM2. It is essential for implementing robust, tamper-resistant key management systems and validating compliance against standards like FIPS 140-2/3.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

This comprehensive guide details techniques for performing forensic investigations on Linux systems. It covers analyzing critical logs—including auth.log, syslog, systemd journal, and auditd—to reconstruct user sessions, trace unauthorized access, detect privilege escalation, and establish detailed event timelines following a suspected security compromise.

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

This tool performs a comprehensive review of OAuth 2.0 scopes, identifying over-permissioned third-party application integrations, excessive API scopes, and unused token grants. It is crucial for implementing the principle of least privilege across complex identity providers and SaaS ecosystems. Use cases include compliance auditing (GDPR, SOC 2), post-incident security reviews, and managing shadow IT risk by auditing cross-boundary consent grants.

A comprehensive assessment tool for the cybersecurity posture of oil and gas critical infrastructure. It covers upstream, midstream, and downstream facilities, evaluating SCADA, DCS, and SIS systems against industry standards like API 1164, IEC 62443, and TSA directives. Ideal for preparing for regulatory compliance audits and identifying security gaps in industrial control systems.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).