Skill UI

Automates tshark and pyshark to parse PCAPs for protocol stats, suspicious flows, DNS anomalies, and IOC extraction during security assessments or incident response drills.

Deploy Zeek to passively capture network packets, parse protocol metadata, and derive high-fidelity logs for threat hunting, anomaly detection, and SIEM ingestion during security assessments or incident response.

Use Claroty xDome to conduct OT vulnerability assessments through passive traffic analysis and safe active queries, correlating CVE and ICS-CERT data, scoring risk, and prioritizing remediation within constrained maintenance windows while supplying compliance evidence.

Analyzes Siemens SIMATIC S7comm and S7CommPlus traffic to surface replay attacks, integrity bypasses, unauthorized CPU stops, and program download manipulation across S7-300/400/1200/1500 PLCs.