Skill UI

Use the VirusTotal API v3 to pull detection verdicts, sandbox behavior, YARA hits, related indicators, and threat context for malware file hashes, helping SOC analysts triage alerts and validate IOCs during response or testing.

Uses YARA rules to rapidly classify malware samples, author detection logic from strings or byte patterns, and stitch scans into automated triage or hunting pipelines for known threats.

Performs static Windows PE malware triage with PEStudio, examining headers, sections, imports, strings, and resources to spot packing, anti-analysis traits, and IOC clues before deciding if sandbox execution is warranted.

Conduct batch malware hunts by crafting YARA rules, compiling them with yara-python, and scanning files, directories, and memory dumps to match malicious patterns or IOCs for triage and post-collection analysis.

This tool provides a structured methodology for triaging raw vulnerability findings generated by DAST and SAST scanners. It utilizes the OWASP risk rating methodology to validate true positives, filter out false positives, and calculate a comprehensive risk score (Risk = Likelihood x Impact). This process significantly reduces alert fatigue and ensures development teams prioritize remediation efforts on the most critical and exploitable vulnerabilities.

Guides SOC analysts through triaging Splunk ES notable events by prioritizing queues, investigating context, correlating telemetry, enriching with threat intelligence, and documenting disposition for escalation or closure.

Guide security analysts through structured incident triage using IR playbooks—from alert intake and enrichment to severity scoring, playbook selection, and team paging—ensuring rapid, repeatable SOC responses.

Use CISA's SSVC decision tree to prioritize vulnerabilities, combining exploitation data, impact, automatability, and mission context to drive actionable remediation schedules.

Guides SOC analysts through NIST SP 800-61r3 and SANS PICERL-based incident triage, covering alert enrichment, severity scoring, classification, and escalation steps for SIEM/EDR-generated threats and IOC matches.

Streamlines issue and PR triage across GitHub and Linear to keep public-facing activity in sync with internal execution lanes, helping teams map active work, classify outcomes, and decide when Linear ownership is warranted.

Structured mailbox workflow covering triage, drafting, sending, and sent-proof verification so ECC users can manage inbox tasks, respond with context, and confirm real-world send status.

Coordinate GitHub repository operations via the gh CLI for issue triage, PR oversight, CI/CD debugging, release preparation, and monitoring dependencies or security alerts.