Skill UI

Develops comprehensive profiles for Advanced Persistent Threat (APT) groups, criminal organizations, and hacktivist collectivities. This tool aggregates TTP documentation, campaign data, and attribution indicators from major intelligence sources (MITRE ATT&CK, Mandiant, CrowdStrike) to help organizations update threat models, prioritize defensive controls, and prepare executive briefings on sector-specific risks.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

This playbook guides SOC analysts through the structured triage of security incidents. It ingests alerts from SIEM platforms (Splunk, Elastic), enriches data using threat intelligence (VirusTotal, AbuseIPDB), classifies the incident type, and calculates a severity score based on asset criticality and data sensitivity. It culminates in creating structured incident tickets and notifying the appropriate response teams via paging systems, ensuring a comprehensive and standardized incident response workflow.

A structured framework for performing initial security incident triage. It guides analysts through classifying incident types using established standards like NIST SP 800-61r3, assigning business impact severity (P1-P4), enriching alerts with threat intelligence, and determining containment and escalation paths. Use when SIEM/EDR alerts require human judgment or when coordinating multiple concurrent security events.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

This skill utilizes AI/LLM reasoning capabilities combined with industry-standard OSINT tools (Sherlock, theHarvester, SpiderFoot). It correlates fragmented data—including usernames, emails, domain records, and breach data—from multiple sources into unified, confidence-scored intelligence profiles. It is ideal for deep target profiling, identity resolution, and mapping complex threat landscapes.

This advanced tool functions as a competitive intelligence partner for Product Managers. It moves far beyond simple feature comparison, helping users map the entire market landscape, identify underlying Jobs-to-be-done, uncover competitor positioning gaps, and generate actionable strategic recommendations. Use it when you need to define a product's unique value proposition or evaluate market threats.

This skill transforms scattered competitive updates (features, pricing, hiring, partnerships) into structured strategic intelligence. It assesses the threat level, determines whether a move is reactive or proactive, and provides concrete implications and actionable recommended responses directly tied to your product roadmap and business strategy.

A comprehensive skill for monitoring dark web forums, marketplaces, and leak sites to detect mentions of organizational assets, leaked credentials, and ongoing threat actor activities. Used for proactive threat intelligence gathering, incident response enrichment, and establishing continuous dark web OSINT coverage.

This skill provides methods to safely monitor and analyze data leak sites (DLS) used by ransomware groups. It extracts structured victim data, tracks group activity trends over time, and generates sector- and geography-specific ransomware risk assessments, crucial for proactive threat intelligence gathering and incident response.

This skill provides a comprehensive solution for monitoring brand impersonation attacks across multiple digital vectors. It systematically scans domains, social media platforms, mobile app stores, and the dark web to detect phishing campaigns, typosquatting, and unauthorized brand usage. It is essential for security teams conducting proactive threat intelligence gathering and vulnerability assessments to safeguard brand integrity.