Skill UI

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers. It normalizes various threat intelligence objects (indicators, actors) into platform-native schemas, enabling automated ingestion, validation, and routing to SIEM, TIP, and EDR systems. Ideal for integrating new ISAC feeds or building bi-directional intelligence pipelines.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

Provides a structured workflow for performing initial triage of security incidents. This process uses established frameworks (NIST SP 800-61r3 and SANS PICERL) to classify the incident type, assign severity based on business impact, and determine the necessary containment and escalation steps. Ideal for analyzing SIEM/EDR alerts, suspicious user reports, or matching threat intelligence.

This skill outlines the architecture and methodology for deploying canary files (honeytokens) across critical file systems. By placing decoy documents with known content in high-value locations, this system monitors for unauthorized modifications, deletions, or encryption attempts. It detects ransomware by triggering high-fidelity alerts via File Integrity Monitoring (FIM) systems, serving as a crucial deception layer that complements existing EDR/AV solutions.

This system detects ransomware by combining multiple advanced techniques: real-time entropy analysis, file system I/O monitoring, and behavioral heuristics. It identifies abnormal mass file modification patterns, sudden spikes in data entropy (indicating encryption), and suspicious process activities like shadow copy deletion. Ideal for building advanced EDR detection layers to catch zero-day and unknown ransomware variants.

This guide provides a comprehensive blueprint for implementing robust Data Loss Prevention (DLP) policies using Microsoft Purview. It covers the configuration of sensitivity labels (encryption, content marking) and the creation of custom DLP rules using regex patterns. The workflow extends to endpoint DLP deployment for controlling file operations on Windows and macOS devices, ensuring sensitive data protection across SharePoint, Exchange, and OneDrive. It leverages PowerShell and the Microsoft Graph API for advanced, programmatic compliance management.

This tool facilitates comprehensive purple team exercises by executing Atomic Red Team tests mapped to MITRE ATT&CK techniques. It is primarily used for gap analysis, validating detection coverage (blue team visibility) against specific threat vectors, and building continuous, automated adversarial emulation pipelines in CI/CD environments.

This skill provides comprehensive management capabilities for AI Integrations within the Arize platform. Users can create, list, retrieve, and update credentials for various Large Language Model (LLM) providers, including OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, and Vertex AI. These integrations are crucial for enabling Arize's advanced monitoring and evaluation features that require invoking external LLMs.

This skill provides comprehensive automation for managing OneDrive file lifecycles. Users can perform advanced operations including searching across metadata and content, uploading and downloading files, organizing folders, creating share links, and granularly managing permissions for specific users. It utilizes a structured workflow approach via Rube MCP, making it ideal for automating business processes involving cloud document storage and collaboration.

Use Composio's Rube MCP suite to orchestrate Pipedrive CRM workflow tasks—deals, contacts, activities, notes, and pipelines—by first calling RUBE_SEARCH_TOOLS for schemas and keeping the connection active before executing each workflow.

This tool generates a complete, structured TypeSpec declarative agent definition tailored for Microsoft 365 Copilot. It systematically creates necessary components including detailed role instructions, conversation starters, and a comprehensive list of required capabilities (e.g., WebSearch, OneDrive, Teams, CodeInterpreter). This ensures the agent is fully functional and ready for deployment within the M365 ecosystem.