Skill UI

This skill provides comprehensive tracking and visualization for Security Operations Center (SOC) performance. It calculates critical metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and alert quality ratios using SIEM data. Ideal for SOC leadership, compliance auditing, and continuous process improvement initiatives needing quantifiable security posture reporting.

This skill provides a comprehensive framework for tracking vulnerability aging and enforcing Service Level Agreements (SLAs). It calculates time-to-remediation against severity-based deadlines (e.g., 14 days for critical), incorporating adaptive modifiers and automated escalation paths. It is essential for establishing compliance policies, measuring remediation efficiency, and managing organizational risk.

DefectDojo is an open-source platform for comprehensive vulnerability management. It aggregates findings from over 200 security scanners (e.g., Nessus, ZAP), automatically deduplicates results, and provides detailed dashboards for tracking remediation progress. It integrates seamlessly with CI/CD pipelines, Jira for ticketing, and Slack for notifications, making it ideal for automated security reporting and compliance tracking in a DevSecOps environment.

This system provides a structured workflow for tracking security vulnerability exceptions and formally accepting related risks. It mandates documentation of compensating controls, manages required approval chains, and automatically handles expiration based on defined Service Level Agreements (SLAs). Essential for maintaining compliance and visibility into accepted risks, supporting frameworks like PCI DSS, SOC 2, and NIST CSF.

This workflow guides SOC teams in establishing a comprehensive, structured process for vulnerability management. It utilizes major scanning tools (Nessus, Qualys, OpenVAS) to discover, prioritize, and track remediation of security weaknesses across the infrastructure. It integrates threat intelligence (CISA KEV) and asset criticality into risk scoring, ensuring resources are focused on the most critical threats.

Build a production-ready, AI-powered data collection agent for any public source (job boards, prices, news, etc.). This agent automatically scrapes data, enriches it using free LLMs (like Gemini Flash), and stores the results in databases such as Notion, Sheets, or Supabase. It runs on a free schedule using GitHub Actions and learns from user feedback, making it ideal for continuous data monitoring and tracking.

This guide provides comprehensive techniques for detecting Layer 2 ARP poisoning and spoofing attacks. It covers monitoring gratuitous ARP floods, tracking IP-to-MAC mapping changes, and identifying rogue devices. Techniques include deploying ARPWatch, configuring Dynamic ARP Inspection (DAI) on managed switches, and using advanced Wireshark filters or custom Python scripts for robust security monitoring and incident response.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

This guide details how to detect T1055 process injection techniques, including DLL injection, process hollowing, and remote thread creation. By analyzing specific Sysmon Event IDs (1, 7, 8, 10, 25) that track cross-process memory operations and handle access, security teams can proactively hunt for defense-evasion activities, investigate EDR alerts, or validate security monitoring coverage.

This comprehensive guide details how to design, deploy, and measure a robust anti-phishing security awareness program. By combining regular simulations, interactive role-based learning modules, and metric tracking, organizations can build a strong security-conscious culture. It covers initial baseline assessments, continuous difficulty scaling, and compliance alignment using industry-leading tools like KnowBe4 and Proofpoint.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

Implements a comprehensive incident ticketing system that connects SIEM alerts to major ITSM platforms like ServiceNow, Jira, or TheHive. This solution formalizes incident tracking, automates ticket creation, and manages critical processes such as Service Level Agreement (SLA) tracking, complex escalation workflows, and compliance documentation throughout the entire incident lifecycle.