Skill UI

This skill monitors dark web forums, ransomware leak sites, and paste sites for early warning intelligence. It tracks organizational assets, leaked credentials, and threat actor communications to enrich incident response and establish proactive monitoring coverage. Essential for cybersecurity teams performing deep OSINT investigations.

This skill provides a comprehensive guide to systematic dark web monitoring, involving scanning underground forums, paste sites, and marketplaces for organizational threats. It covers setting up Tor-based crawling, automating credential leak detection (e.g., HIBP integration), and analyzing threat intelligence (CTI) using Python. Essential for proactive incident response and security auditing.

A comprehensive guide for Security Operations Center (SOC) analysts on reducing false positive alerts in SIEM systems. Techniques include systematic threshold tuning, refining correlation logic, implementing allowlisting, and enriching data with threat intelligence to combat alert fatigue and improve detection accuracy.

This skill guides the systematic management of Indicators of Compromise (IOCs). It covers the entire lifecycle, from initial discovery and validation through enrichment (e.g., VirusTotal, Shodan) and deployment to SIEM/IDS. Key features include confidence decay over time, false positive tracking, and automated retirement policies, ensuring the threat intelligence database remains high-quality and actionable.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill utilizes the Shodan API to perform comprehensive IP reputation analysis. It enriches IP addresses by identifying open ports, running services, known vulnerabilities (CVEs), and hosting context. It is crucial for threat intelligence enrichment, incident triage, and security assessments, helping security professionals assess the risk level and potential compromise of exposed infrastructure.

This skill leverages the VirusTotal API v3 to enrich file hashes (MD5, SHA-256). It retrieves comprehensive security data, including multi-engine detection rates, sandbox behavioral reports, YARA rule matches, and related Indicators of Compromise (IOCs). It is essential for SOC triage, incident response, and threat intelligence workflows.

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.

This skill automates the monitoring of public paste sites (e.g., Pastebin, GitHub Gists) to detect leaked credentials, API keys, and sensitive data dumps. It employs advanced regex patterns and keyword matching to provide early warning of security breaches, crucial for incident response, vulnerability assessment, and threat intelligence gathering.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers. It normalizes various threat intelligence objects (indicators, actors) into platform-native schemas, enabling automated ingestion, validation, and routing to SIEM, TIP, and EDR systems. Ideal for integrating new ISAC feeds or building bi-directional intelligence pipelines.