Skill UI

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

A comprehensive guide to deploying deception technologies, including honeypots, honeytokens, and decoy systems, within a Security Operations Center (SOC). This skill is used to detect advanced attackers who bypass perimeter defenses by monitoring lateral movement, credential abuse, and internal reconnaissance. It provides high-fidelity, near-zero false positive alerts and is essential for threat hunting and incident response strategy.

This guide outlines systematic methodologies for reducing false positives in Security Information and Event Management (SIEM) systems. It covers advanced techniques including threshold tuning, multi-signal correlation enhancement, behavioral baseline integration, and threat intelligence filtering. Used by SOC analysts and detection engineers to combat alert fatigue and improve true positive detection rates.

This skill automates the enrichment of Indicators of Compromise (IOCs) by orchestrating lookups across multiple industry-leading threat intelligence sources (e.g., VirusTotal, AbuseIPDB, Shodan). It provides contextual scoring and disposition recommendations for IPs, domains, URLs, and hashes. Ideal for SOC analysts during alert triage or incident investigation to quickly assess risk and scope.

This skill leverages the VirusTotal API to perform comprehensive threat intelligence enrichment on file hashes (MD5, SHA-1, SHA-256). It retrieves detection rates from 70+ AV engines, behavioral sandbox reports, associated indicators of compromise (IOCs), and contextual threat data. Use this tool for rapid SOC triage, accurate incident response validation, and enhancing threat hunting workflows.

This tool performs a comprehensive review of OAuth 2.0 scopes, identifying over-permissioned third-party application integrations, excessive API scopes, and unused token grants. It is crucial for implementing the principle of least privilege across complex identity providers and SaaS ecosystems. Use cases include compliance auditing (GDPR, SOC 2), post-incident security reviews, and managing shadow IT risk by auditing cross-boundary consent grants.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

This guide details the systematic process for reviewing high-privilege accounts, including Domain Admins, cloud IAM roles, and service accounts. It is a critical identity governance function designed to validate that users only retain the access they absolutely require, thereby enforcing the principle of least privilege. This review is mandatory for compliance frameworks like SOC 2, PCI DSS, and HIPAA, and involves discovery, validation, remediation, and continuous monitoring.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

This guide provides a comprehensive methodology for auditing essential HTTP security headers, including CSP, HSTS, X-Frame-Options, and Referrer-Policy. It helps identify missing or improperly configured browser-level protections, crucial for mitigating vulnerabilities like XSS, clickjacking, and mixed content issues, ensuring compliance with standards like PCI DSS and SOC 2.