Skill UI

This guide demonstrates how to programmatically create, validate, and exchange complex structured threat intelligence objects (Indicators, Malware, Campaigns) using the STIX 2.1 standard and the stix2 Python library. It covers the full lifecycle of intelligence sharing, including defining patterns and publishing data via TAXII 2.1, making it essential for building sophisticated Threat Intelligence Platforms (TIPs) and integrating with SIEM/SOAR systems.

This guide details the implementation of comprehensive security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection. It covers deploying the Datadog Agent across hybrid cloud infrastructure (AWS, Azure, GCP), ingesting critical log sources (CloudTrail, VPC Flow Logs, etc.), configuring Workload Protection, and creating custom detection rules to detect threats, enforce compliance, and provide centralized SOC visibility.

This guide details how to implement advanced SIEM correlation rules to detect sophisticated Advanced Persistent Threats (APTs). By chaining multiple event types—including Windows authentication events, process execution telemetry, and network connection logs—across hosts, users can surface complex attack sequences that are invisible to single-event detections. It utilizes Splunk SPL and Sigma rule formats for robust security posture enhancement.

Systematically optimizes Security Information and Event Management (SIEM) detection rules in platforms like Splunk and Elastic. This process involves analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and statistically adjusting detection thresholds to significantly reduce false positives, improving overall security efficacy.

This skill guides the process of designing, implementing, and validating advanced security detection use cases for Security Information and Event Management (SIEM) platforms like Splunk, Elastic, and Microsoft Sentinel. It focuses on mapping organizational threat profiles to the MITRE ATT&CK framework to build formal, high-fidelity detection rules, thereby strengthening Security Operations Center (SOC) coverage and reducing blind spots.

This skill provides a comprehensive guide to integrating STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information). It covers using Python to consume and produce cyber threat intelligence feeds, including server discovery, object fetching, and parsing of STIX 2.1 objects for integration into SIEM and TIP platforms.

This skill guides the deployment and configuration of a TAXII 2.1 server using OpenTAXII. It enables automated, standardized exchange of STIX-formatted cyber threat intelligence (CTI) indicators between organizations. Use cases include establishing secure threat sharing pipelines, integrating with SIEM/SOAR platforms, and meeting stringent compliance requirements.

Build a PyMISP-driven threat intelligence platform that ingests multiple IOC feeds, tags MITRE ATT&CK techniques, enriches data via VirusTotal and AbuseIPDB, and exports STIX 2.1 bundles for SIEM pipelines.

Implements a comprehensive incident ticketing system that connects SIEM alerts to major ITSM platforms like ServiceNow, Jira, or TheHive. This solution formalizes incident tracking, automates ticket creation, and manages critical processes such as Service Level Agreement (SLA) tracking, complex escalation workflows, and compliance documentation throughout the entire incident lifecycle.

This skill provides SOC teams with a structured, multi-source workflow to investigate potential insider threats. It correlates data from SIEM, DLP, EDR, and HR feeds to detect data exfiltration attempts (via cloud, USB, email), unauthorized access patterns, and policy violations. It is crucial for building comprehensive investigation timelines, especially when handling departing employees or suspected data theft.

A comprehensive guide for SOC analysts and digital forensics experts. This skill covers the entire lifecycle of a phishing incident, from initial user report and header analysis (SPF, DKIM, DMARC) to detonating malicious URLs/attachments in sandboxes. It guides users on scoping the attack, identifying impacted users via SIEM/proxy logs, and executing containment measures like email purges.

This skill maps observed adversary behaviors, security alerts, and detection rules to the MITRE ATT&CK framework. It is essential for quantifying detection coverage, building ATT&CK heatmaps, tagging SIEM alerts, and prioritizing security controls based on known threat actor playbooks. Use it for comprehensive gap analysis and risk reporting.