Skill UI

This guide details the implementation of the three core email authentication protocols: SPF, DKIM, and DMARC. By configuring these DNS records, users can prevent domain spoofing, ensure message integrity, and define strict policies (quarantine/reject) for unauthenticated emails, drastically reducing exposure to phishing and spoofing attacks.

This skill guides the deployment and configuration of the Dragos Platform for specialized Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages industrial protocol parsers and threat intelligence to detect sophisticated threats (e.g., VOLTZITE). It is essential for establishing OT Security Operations Centers (SOCs) or integrating dedicated ICS monitoring capabilities into enterprise SIEM solutions.

This skill guides the implementation of email sandboxing using Proofpoint Targeted Attack Protection (TAP). It covers configuring isolated detonations for suspicious attachments and URLs to detect zero-day malware, evasive phishing, and advanced threats. Learn to tune policies, monitor the TAP dashboard, and integrate findings with SIEM for robust email security architecture.

Audits a domain’s email authentication by querying SPF, DKIM, and DMARC DNS records using dnspython, validating syntax/counts, flagging common spoofing risks, and producing remediation guidance.

This skill implements a simplified version of the Signal Protocol, focusing on robust end-to-end encryption (E2EE) for messaging applications. It covers critical cryptographic components including X3DH key agreement, the Double Ratchet algorithm for continuous key management, and AES-256-GCM for message encryption. The implementation ensures forward secrecy, meaning that compromising a current key does not reveal past messages. Use this when designing, building, or evaluating the security architecture of a messaging service to guarantee that only communicating parties can read the messages.

A comprehensive guide to deploying and configuring Wazuh SIEM/XDR for robust endpoint detection and response. This skill covers agent authentication and management via API, creating custom decoders and rules, querying security alerts, and validating rule logic using logtest functionality.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

This skill guide details the implementation of envelope encryption using AWS Key Management Service (KMS). It outlines the secure process of using a Data Encryption Key (DEK) to encrypt data locally, and subsequently protecting that DEK with a KMS-managed Key Encryption Key (KEK). This method is crucial for encrypting large data volumes on AWS, significantly reducing direct KMS API calls, improving performance, and maintaining compliance with strict security standards.

This skill automates the process of vulnerability prioritization by querying the FIRST Exploit Prediction Scoring System (EPSS) API. It calculates the real-world probability of a CVE being exploited within 30 days, providing a crucial risk metric that surpasses traditional CVSS severity scoring. Use it for risk-based vulnerability management, allowing security teams to efficiently triage and remediate the most actively threatened vulnerabilities first.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

This guide details how to implement coverage-guided fuzz testing using AFL++ within CI/CD pipelines. It covers building the fuzzing harness, utilizing advanced instrumentation (like AddressSanitizer), and configuring automated runs to discover memory corruption and input handling vulnerabilities in compiled applications. Ideal for strengthening DevSecOps practices and ensuring code reliability.

This guide details the implementation of GCP Binary Authorization, a crucial deploy-time security control. It ensures that only trusted, verified container images are deployed on GKE or Cloud Run by requiring cryptographic attestations. Learn how to set up KMS-backed attestors, configure policies, and integrate the validation process into your CI/CD pipeline to enforce robust supply chain integrity.