Skill UI

This skill details the deployment and advanced querying techniques for Arkime (Moloch), enabling comprehensive full packet capture network traffic analysis. Users can leverage the Arkime API v3 to search connections, download PCAPs, detect sophisticated C2 beaconing, and analyze connection patterns and anomalies across DNS, HTTP, and TLS traffic. Essential for security monitoring and network forensics.

This skill guides the implementation of network traffic baselining using historical NetFlow/IPFIX data. It leverages Python's pandas library to compute detailed statistical profiles, including hourly/daily distributions, per-host metrics, and protocol ratios. Anomalies are robustly detected using z-score and Interquartile Range (IQR) methods, assisting SOC analysts in identifying unusual activities like data exfiltration or beaconing.

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

This guide details the implementation of advanced, phishing-resistant, passwordless authentication using Microsoft Entra ID. It covers configuring FIDO2 security keys, Windows Hello for Business, and passkey support via Microsoft Authenticator. Use this skill to eliminate reliance on passwords, mitigate credential stuffing attacks, and satisfy strict regulatory mandates for modern identity access management.

A comprehensive guide to deploying FIDO2/WebAuthn passwordless authentication using security keys and biometric platform authenticators. It covers crucial steps such as WebAuthn API integration, FIDO2 server configuration, and passkey enrollment, ensuring secure migration away from traditional password-based systems and aligning with stringent compliance standards like NIST SP 800-63B AAL3.

A comprehensive guide to implementing PCI DSS 4.0.1 requirements for organizations handling cardholder data. This skill covers the full compliance lifecycle, from defining the Cardholder Data Environment (CDE) scope and hardening network security, to implementing advanced data encryption, access controls (MFA/RBAC), and continuous monitoring mechanisms.

Pod Security Admission (PSA) is a built-in Kubernetes admission controller designed to enforce Pod Security Standards (Baseline, Restricted, Privileged) at the namespace level. It serves as a crucial replacement for the deprecated PodSecurityPolicy (PSP), allowing users to implement robust security controls and maintain compliance. By applying specific labels, administrators can set enforcement modes (enforce, audit, warn) to harden container environments against unauthorized privilege escalation and security risks.

This comprehensive guide details the deployment of Privileged Access Management (PAM) using CyberArk. Learn how to secure the enterprise by discovering, vaulting, rotating, and monitoring highly privileged credentials. The process covers vault architecture design, policy configuration, session isolation via PSM, and integration with SIEM systems, ensuring adherence to strict compliance standards like NIST 800-53.

This guide details the comprehensive implementation of privileged session monitoring and recording using Privileged Access Management (PAM) solutions, such as CyberArk PSM. It covers essential steps including architectural routing, configuring keystroke logging, real-time risk analysis, and establishing secure, tamper-proof audit trails for critical administrative access (RDP, SSH, Databases). Essential for meeting strict compliance standards like SOX, HIPAA, and PCI-DSS.

This guide details the implementation of a robust, ransomware-resilient backup architecture following the extended 3-2-1-1-0 rule. It covers critical steps such as classifying assets, defining RPO/RTO, implementing immutable or air-gapped storage, and isolating backup credentials from the production domain. Use this knowledge to design a multilayered defense against data loss and ensure reliable recovery points.

This skill covers the comprehensive management of RSA key pairs, including generation, secure storage, rotation, and validation. It adheres to NIST guidelines, covering key serialization formats (PEM, DER, PKCS#8), passphrase protection, and ensuring robust key strength for digital signatures and encryption.

Tetragon, a CNCF project under Cilium, provides advanced, kernel-level runtime security observability and policy enforcement in Kubernetes clusters. By utilizing eBPF, it monitors process execution, file access, and network connections with minimal overhead, enabling detection and prevention of container escapes, unauthorized access, and suspicious activity.