Skill UI

Performs proactive threat hunting inside Elastic Security SIEM by crafting KQL/EQL hunting queries, translating findings into detection rules, and using Timelines to investigate anomalies that evade automated alerts.

Build forensic super-timelines with Plaso's log2timeline/psort suite, ingesting disk images and artifacts, applying parser or filter selections, and exporting to Timeline Explorer or Timesketch to correlate events across investigations.

Use Eric Zimmerman’s EZ Tools suite with KAPE orchestrating MFTECmd, PECmd, RECmd and related utilities to parse registries, MFT, prefetch, logs and jump lists for structured Windows forensic timelines.

Parses Windows LNK shortcut files to capture target paths, timestamps, volume info, and machine IDs, enabling forensic analysts to rebuild user activity timelines and cross-reference file access across shares and removable devices.

Transforms validated research ideas into structured, reviewer-ready grant proposals for agencies such as KAKENHI, NSF, NSFC, ERC, DFG, SNSF, ARC, and NWO, handling narrative arcs, agency-specific sections, budgets, timelines, and fixed review checkpoints before finalizing.

Hunt for threats in AWS environments by leveraging Detective behavior graphs, correlated GuardDuty findings, and automated entity timelines spanning IAM users, EC2 instances, and IP addresses to streamline cloud-native incident investigations.

Guides multi-round investigation of any GitHub repository, combining API queries, discovery searches, and deep dives to produce structured markdown reports with summaries, timelines, metrics tables, and Mermaid diagrams for executive-ready briefs.