Skill UI

Implement robust, structured logging for API requests, capturing performance metrics, correlation IDs, and detailed security audit trails. This skill ensures compliance by handling PII redaction and providing comprehensive, JSON-formatted logs suitable for ELK Stack or Loki. Essential for debugging, performance analysis, and maintaining SOC 2 compliance in distributed microservices.

This guide details how to write advanced correlation searches using Splunk's Search Processing Language (SPL). It covers techniques like threshold-based detection, sequence analysis, and anomaly detection to identify sophisticated security threats (e.g., brute force, data exfiltration, lateral movement) in a Security Operations Center (SOC) environment. Mastery of SPL is essential for closing SIEM detection gaps and ensuring compliance.

This skill guides SOC analysts and detection engineers on how to correlate complex, multi-stage attacks within the IBM QRadar SIEM platform. It covers advanced usage of AQL (Ariel Query Language) for deep event investigation, building custom correlation rules (Building Blocks and Offenses), and cross-source data correlation (e.g., auth failures with network flows). It is essential for reducing false positives and improving threat detection accuracy.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.

This skill uses advanced AI and LLM capabilities to correlate fragmented Open Source Intelligence (OSINT) data. It ingests findings from diverse sources—including username enumeration, email lookups, social media, domain records, and breach databases—to generate unified, intelligence-grade profiles. It provides link analysis and confidence scoring, transforming raw data into actionable threat intelligence for target profiling.

This skill guides users on performing advanced, cloud-native threat hunting using AWS Detective. It leverages interactive behavior graphs, entity investigation timelines, and GuardDuty correlations to automatically analyze AWS logs (CloudTrail, VPC Flow Logs, etc.). Users can efficiently investigate suspicious IAM users, detect lateral movement, and correlate complex attack narratives across multiple AWS services.

Improves Go error handling by treating errors as structured data. This utility adds critical context—such as domain, user IDs, stack traces, and machine-readable error codes—to standard Go errors. This capability is vital for enhancing observability, enabling APM tools (like Sentry or Datadog) and on-call engineers to diagnose complex issues quickly without relying on manual log correlation.

This guide provides a systematic approach to deep debugging complex HubSpot API issues. It includes layer-by-layer network testing (DNS, TCP, TLS), correlation ID tracking, and timing analysis to isolate intermittent or hard-to-reproduce errors. Use this when standard troubleshooting fails or when compiling detailed evidence for technical support.

This guide provides a comprehensive framework for debugging and analyzing AgentCore runtime sessions using CloudWatch Logs Insights. It details advanced techniques like OpenTelemetry (OTEL) span correlation, resolving session IDs to trace IDs, and structuring complex query queries. Use this when investigating agent execution flows, diagnosing tool call failures, analyzing latency, or building detailed behavioral timelines.