Skill UI

A comprehensive guide on configuring advanced email security gateways (SEGs) to detect and block sophisticated, targeted spearphishing attacks. This skill covers essential detection layers, including impersonation protection, real-time URL detonation, attachment sandboxing, and creating custom behavioral rules. It is crucial for SOC analysts and security engineers building robust email threat defense systems.

This guide details how to implement AWS Config managed and custom rules to establish continuous compliance monitoring for AWS resources. It helps detect configuration drift against standards like CIS and PCI DSS, enabling automated remediation using services like SSM Automation. It is ideal for building centralized compliance dashboards and aggregating audit evidence across multiple AWS accounts via AWS Organizations.

This skill covers the deployment and fine-tuning of Web Application Firewall (WAF) rules across major cloud platforms like AWS, Azure, and Cloudflare. It addresses critical security needs such as mitigating OWASP vulnerabilities (SQLi, XSS), managing bot traffic, implementing rate limiting, and ensuring compliance (e.g., PCI-DSS). The workflow guides users through deploying managed rule sets, creating custom rate-based logic, and minimizing false positives.

A comprehensive guide to deploying and configuring Wazuh SIEM/XDR for robust endpoint detection and response. This skill covers agent authentication and management via API, creating custom decoders and rules, querying security alerts, and validating rule logic using logtest functionality.

This guide details the deployment and configuration of Suricata as a high-performance, inline Intrusion Prevention System (IPS). It covers setting up NFQueue mode, writing custom detection rules, managing commercial and community rulesets (like Emerging Threats), and optimizing performance for active, real-time blocking of malicious network traffic. Essential for robust security architecture and compliance.

This skill guides the implementation of Gitleaks for robust secret scanning across development lifecycles. It covers setting up pre-commit hooks to prevent secrets from being committed, integrating scanning into CI/CD pipelines (like GitHub Actions), and writing custom regex rules to detect and remediate hardcoded credentials (API keys, passwords, tokens) in Git history, ensuring adherence to secure SDLC practices.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

A comprehensive guide detailing how to perform rapid malware triage and classification using YARA rules. Learn to write sophisticated rules that match file patterns, unique strings, byte sequences, and structural PE characteristics. Ideal for automating signature-based scanning, developing custom detection rules for zero-day threats, and building robust analysis pipelines.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This skill demonstrates how to secure AWS API Gateway endpoints using AWS WAF (Web Application Firewall). It implements essential security measures including protection against OWASP Top 10 vulnerabilities, custom rate-limiting rules, IP reputation filtering, and bot control. Ideal for deploying public API endpoints that require robust defense against common web attacks and API abuse.

A comprehensive guide for implementing Data Loss Prevention (DLP) policies across the Microsoft 365 ecosystem using Microsoft Purview. It details how to protect PII, PHI, and PCI data across Exchange Online, SharePoint, OneDrive, and endpoints. Key features include configuring custom sensitivity labels, regex-based sensitive information types, and endpoint DLP rules via PowerShell, ensuring robust compliance and data governance.