Skill UI

Skill Sentinel audits and evolves a skills ecosystem by analyzing quality, security, cost, governance, documentation, dependencies, and cross-skill duplication, then generates health reports, recommendations, and orchestrates assessments for teams managing multiple automations.

This skill details the implementation of a cloud-native SIEM and SOAR platform using Microsoft Sentinel. It covers ingesting multi-cloud logs (AWS, Azure, GCP), writing advanced KQL detection queries for threat hunting, and automating incident response workflows using Logic Apps. Ideal for centralized security operations in complex, multi-cloud environments.

This skill provides a comprehensive workflow for building vendor-agnostic detection rules using the Sigma format. It empowers security operations center (SOC) engineers to translate raw threat intelligence and MITRE ATT&CK techniques into standardized, portable detection logic. The process guides users through rule validation and conversion into specific queries for major SIEM platforms, including Splunk, Elastic, and Microsoft Sentinel, ensuring robust detection coverage.

Focuses on advanced threat detection within Azure AD/Entra ID. This skill guides users on correlating Graph API audit logs, sign-in anomalies, and KQL queries in Microsoft Sentinel to identify sophisticated lateral movement techniques, such as privilege escalation, OAuth abuse, and cross-tenant pivoting. Essential for SOC threat hunting.

This skill guides the process of designing, implementing, and validating advanced security detection use cases for Security Information and Event Management (SIEM) platforms like Splunk, Elastic, and Microsoft Sentinel. It focuses on mapping organizational threat profiles to the MITRE ATT&CK framework to build formal, high-fidelity detection rules, thereby strengthening Security Operations Center (SOC) coverage and reducing blind spots.

A comprehensive toolkit for advanced geospatial analysis. It covers remote sensing (Sentinel, Landsat), GIS operations (vector/raster/point cloud), spatial statistics, and Machine Learning for Earth Observation. Supports cloud-native workflows, multiple data types, and 8 programming languages, making it ideal for complex scientific research and commercial spatial projects.

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

This skill provides advanced threat hunting logic for Microsoft Sentinel/Log Analytics. It analyzes both AADGraphActivityLogs and MicrosoftGraphActivityLogs to detect the unique fingerprints and behavioral patterns left by offensive Entra ID tools (like ROADtools, AADInternals, and AzureHound). It detects specific User-Agent strings and characteristic endpoint-sweep patterns, even when tool authors attempt to spoof headers, helping SOC teams identify valid account-based adversary activity (MITRE T1078.004).

A static analysis tool that audits SQL code for common cost and performance anti-patterns (e.g., full-table scans, Cartesian joins). It calculates a query health score (0-100) for data warehouses like BigQuery, Snowflake, and Redshift, providing a prioritized, actionable plan with concrete fixes and estimated cost savings. Essential for FinOps and data quality assurance.