Skill UI

This skill guides users through implementing and managing Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. Learn how to assign security profiles (Privileged, Baseline, Restricted) to namespaces, audit existing workloads for compliance, plan migrations from deprecated PSPs, and adjust securityContext settings to meet high hardening and compliance requirements.

This tool builds a tamper-evident, append-only log chain using SHA-256 hash chaining. By incorporating the previous entry's hash into the current entry, any modification to an old log entry will invalidate all subsequent hashes, enabling pinpoint tamper detection. It supports various log formats (syslog, JSON, plain text) and is essential for compliance, digital forensics, and verifying log authenticity in security operations.

This tool implements critical NERC CIP controls for Bulk Electric System (BES) cyber systems, covering asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013). It is essential for maintaining compliance, preparing for audits, and commissioning new BES assets.

This skill details the deployment of Privileged Access Management (PAM) for critical database systems, including Oracle, SQL Server, PostgreSQL, and MySQL. It covers essential security controls such as session proxy configuration, credential vaulting, query auditing, and enforcing least-privilege access, helping organizations meet stringent compliance and security standards.

This skill details how to configure and manage the Kubernetes Pod Security Admission (PSA) controller. PSA enforces Pod Security Standards (Privileged, Baseline, Restricted) at the namespace level, replacing the deprecated PodSecurityPolicy. It guides users on setting cluster-wide defaults, applying standards via labels, and utilizing 'enforce', 'audit', or 'warn' modes for robust cluster security and debugging.

This guide outlines best practices for hardening Kubernetes Role-Based Access Control (RBAC). It focuses on implementing least-privilege principles by auditing and removing excessive cluster-admin bindings, scoping roles to namespaces, separating service accounts, and integrating external OIDC providers. Use this when improving cluster security posture, meeting compliance standards, or mitigating privilege escalation risks.

This guide details configuring ModSecurity WAF and OWASP Core Rule Set (CRS) for comprehensive web application security auditing. It covers essential steps such as initial deployment, rule tuning to minimize false positives, configuring detailed audit logging, and integrating logs into SIEM systems for robust threat detection.

This guide details the process of performing Active Directory reconnaissance using BloodHound and SharpHound. It leverages graph theory to visualize hidden trust relationships, group memberships, and ACLs, mapping the shortest attack paths from a low-privilege compromised user all the way to Domain Admin rights. This is essential for red-teaming, security auditing, and identifying critical misconfigurations.

This skill utilizes Impacket to perform comprehensive audits and simulated attacks on Active Directory forest trust relationships. It enumerates trust boundaries, analyzes SID filtering configurations, detects SID history abuse vectors, and assesses inter-realm Kerberos ticket risks. Ideal for red-teaming multi-forest environments or performing deep security audits to find cross-forest privilege escalation paths.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.