Skill UI

This skill outlines a comprehensive, structured workflow for managing Microsoft Patch Tuesday security updates. It covers the entire lifecycle, from initial vulnerability triage and risk assessment to testing, staged deployment (Pilot, Production Rings), and final validation, ensuring compliance with risk-based remediation SLAs.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

A comprehensive guide detailing the process of identifying and exploiting SQL injection vulnerabilities in web applications. The content covers manual and automated techniques, including error-based, boolean, and time-based blind injections. Users learn to fingerprint major database engines (MySQL, MSSQL, Oracle) and utilize tools like sqlmap to demonstrate data extraction and security risks during authorized penetration tests.

The Metasploit Framework is the industry standard platform for penetration testing and vulnerability validation. It provides numerous modules (exploits, payloads, auxiliaries) used to confirm if identified security weaknesses are genuinely exploitable. This guide details using Metasploit in a structured, risk-based workflow for authorized testing, including vulnerability checking, post-exploitation assessment, and patch verification.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This skill provides comprehensive guidance on implementing Conditional Access policies within Microsoft Entra ID (Azure AD). It covers configuring zero trust access control, integrating signal-based policies, enforcing device compliance, and utilizing risk-based authentication. This is crucial for establishing robust security architectures aligned with NIST standards and regulatory compliance requirements.

Integrates FIRST's Exploit Prediction Scoring System (EPSS) API to estimate the probability of a CVE being exploited in the wild within 30 days. This tool moves beyond traditional severity scoring (CVSS) by providing a likelihood measure, allowing security teams to implement a risk-based remediation strategy by combining EPSS scores with CVSS scores to assign immediate, urgent, or low priorities.

This skill guides the implementation of continuous, risk-adaptive identity verification crucial for Zero Trust Architecture (ZTA). It covers deploying phishing-resistant MFA (FIDO2/WebAuthn), advanced risk-based conditional access policies, and identity governance strategies. Users learn how to move beyond traditional credentials by leveraging multiple signals—such as device posture, behavioral biometrics, and location context—to dynamically assess and enforce trust levels before granting access.

This skill guides the design and implementation of security zones and conduits for Industrial Automation and Control Systems (IACS) following IEC 62443-3-2 standards. It covers risk-based zone partitioning, defining security levels (SL-T), deploying microsegmentation using industrial firewalls, and validating the architecture against the Purdue Model.

This skill covers the complete lifecycle for establishing, implementing, and maintaining an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. Users learn the full process, from initial gap analysis and risk assessment (including defining risk treatment plans) to selecting Annex A controls, developing the Statement of Applicability (SoA), conducting internal audits, and preparing for final certification. It is essential for organizations needing to achieve formal security compliance and robust governance.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

A comprehensive guide to securing Kubernetes Role-Based Access Control (RBAC). It teaches best practices for implementing least-privilege policies, eliminating excessive cluster-admin bindings, utilizing namespace-scoped roles, and integrating external identity providers (OIDC) to mitigate risks like privilege escalation and unauthorized data access.