Skill UI

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers. It normalizes various threat intelligence objects (indicators, actors) into platform-native schemas, enabling automated ingestion, validation, and routing to SIEM, TIP, and EDR systems. Ideal for integrating new ISAC feeds or building bi-directional intelligence pipelines.

Develops comprehensive profiles for Advanced Persistent Threat (APT) groups, criminal organizations, and hacktivist collectivities. This tool aggregates TTP documentation, campaign data, and attribution indicators from major intelligence sources (MITRE ATT&CK, Mandiant, CrowdStrike) to help organizations update threat models, prioritize defensive controls, and prepare executive briefings on sector-specific risks.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

Provides a structured workflow for performing initial triage of security incidents. This process uses established frameworks (NIST SP 800-61r3 and SANS PICERL) to classify the incident type, assign severity based on business impact, and determine the necessary containment and escalation steps. Ideal for analyzing SIEM/EDR alerts, suspicious user reports, or matching threat intelligence.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

This skill uses advanced AI and LLM capabilities to correlate fragmented Open Source Intelligence (OSINT) data. It ingests findings from diverse sources—including username enumeration, email lookups, social media, domain records, and breach databases—to generate unified, intelligence-grade profiles. It provides link analysis and confidence scoring, transforming raw data into actionable threat intelligence for target profiling.

This advanced tool functions as a competitive intelligence partner for Product Managers. It moves far beyond simple feature comparison, helping users map the entire market landscape, identify underlying Jobs-to-be-done, uncover competitor positioning gaps, and generate actionable strategic recommendations. Use it when you need to define a product's unique value proposition or evaluate market threats.

This skill transforms scattered competitive updates (features, pricing, hiring, partnerships) into structured strategic intelligence. It assesses the threat level, determines whether a move is reactive or proactive, and provides concrete implications and actionable recommended responses directly tied to your product roadmap and business strategy.

A comprehensive skill for monitoring dark web forums, marketplaces, and leak sites to detect mentions of organizational assets, leaked credentials, and ongoing threat actor activities. Used for proactive threat intelligence gathering, incident response enrichment, and establishing continuous dark web OSINT coverage.

This skill provides a structured approach to monitoring and analyzing data leak sites (DLS) maintained by ransomware groups. By extracting structured data on victim postings, threat group tactics, and sector-specific details, users can assess current ransomware risk, track attack trends, and proactively build robust defense strategies.