Skill UI

This tool guides the deployment and configuration of the Dragos Platform for critical Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages over 600 industrial protocol parsers and advanced threat intelligence to detect sophisticated attacks (e.g., VOLTZITE, GRAPHITE). Use it for building an OT Security Operations Center (SOC), asset discovery, and vulnerability management in industrial settings, integrating alerts with enterprise SIEMs.

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

This comprehensive skill guides the deployment and configuration of Wazuh SIEM/XDR for robust endpoint monitoring. Users will learn to manage agents via the API, create custom decoders and rules (XML), query security alerts, and test rule logic, enabling organizations to establish strong security controls and automate incident response.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

This skill guides the implementation of File Integrity Monitoring (FIM) using AIDE (Advanced Intrusion Detection Environment). It covers setting up AIDE configurations, creating initial baselines, performing scheduled integrity checks, and parsing detailed change reports. This is essential for maintaining strong security controls, meeting compliance requirements, and detecting unauthorized system modifications on Linux environments.

The GCP Organization Policy Service allows administrators to enforce centralized security guardrails and governance policies across an entire resource hierarchy (organization, folder, project). By defining constraints (List, Boolean, Custom), users can restrict risky resource configurations, ensuring compliance with internal security standards and external regulations. Ideal for security architecture, compliance checks, and cloud governance implementation.

This guide provides comprehensive security hardening procedures for enterprise Google Workspace environments. It covers advanced topics such as enforcing phishing-resistant Multi-Factor Authentication (MFA), configuring email authentication (DMARC/SPF/DKIM), implementing Data Loss Prevention (DLP), and securing super admin accounts using Advanced Protection Program enrollment. Ideal for achieving high compliance and defending against BEC and phishing attacks.

A comprehensive guide to implementing advanced security measures in Google Workspace. This covers enhanced pre-delivery scanning, anti-spoofing detection, attachment protection, and setting up Enhanced Safe Browsing to safeguard against sophisticated phishing and malware attacks within organizational emails. Ideal for security administrators and compliance teams.

This comprehensive guide details how to implement Single Sign-On (SSO) for Google Workspace using the SAML 2.0 protocol. It guides administrators through connecting a third-party Identity Provider (IdP) like Okta or Azure AD to centralize authentication, enforce MFA, and manage access policies across the organization.

This guide details the deployment of deception technologies, including canary files and honeypot shares, to detect ransomware activity at its earliest stages. It outlines configuring file integrity monitoring (FIM) and using specialized tokens to trigger alerts when ransomware attempts encryption or performs lateral movement, significantly enhancing security posture beyond standard EDR.

This guide details the process of deploying and configuring Tofino industrial firewalls for critical OT/ICS environments. It provides architectural blueprints and Python-based rule generators to implement deep packet inspection (DPI) for key industrial protocols like Modbus, EtherNet/IP, and S7comm. This ensures granular, protocol-aware access control and robust zone segmentation for safeguarding SCADA and PLCs.

This guide details implementing robust container image provenance verification using Cosign, a Sigstore tool. It covers key-based and keyless (OIDC) signing methods, enabling secure supply chain practices. Users can sign images, attach critical attestations (such as SBOMs and vulnerability scans), and enforce verification in CI/CD pipelines and Kubernetes environments to ensure high integrity and trust.