Results for “correlation”

Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.

The English summary is being prepared. Showing the original description.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

The English summary is being prepared. Showing the original description.

Load for .NET observability changes involving structured logs/Loki, Prometheus metrics, OpenTelemetry traces, exception handling, correlation IDs, dashboards, alerts, or production error diagnosis; not for ordinary business validation errors.

The English summary is being prepared. Showing the original description.

Econometrics skill for time series analysis. Activates when the user asks about: "time series", "stationarity", "unit root test", "ADF test", "KPSS test", "ARIMA", "ARMA", "autocorrelation", "ACF", "PACF", "VAR model", "VECM", "Granger causality", "cointegration", "impulse response function", "forecast", "seasonal decomposition", "ARCH", "GARCH", "时间序列", "平稳性检验", "单位根", "自回归", "格兰杰因果", "协整", "脉冲响应", "预测", "向量自回归"

The English summary is being prepared. Showing the original description.

Knowledge base from the NASA Schedule Management Handbook (2024 edition, Revision 2). Use for program/project schedule management of aerospace and large engineering efforts: the five sub-functions (Planning, Development, Assessment & Analysis, Maintenance & Control, Documentation & Communication); the Integrated Master Schedule (IMS) and the WBS/OBS/CBS breakdown structures; the Schedule Management Plan (SMP) and Basis of Estimate (BoE); Critical Path Method, logic, durations, float and margin; tiered schedule assessment (Requirements/Health/Basis checks, the Shock Test) and the Dimensions of Schedule Reliability; Schedule Risk Analysis (SRA), Integrated Cost-Schedule Risk Analysis (ICSRA), Monte Carlo, correlation, merge bias, and the Joint Confidence Level (JCL); baselining, replan vs. rebaseline, EVM schedule metrics (SPI, BEI, CEI, HMI, Earned Schedule, CPLI), and status/progress/forecast reporting. This is NASA's scheduling doctrine grounded in NPR 7120.5 and the GAO Schedule Assessment Guide. Thin on the underlying mechanics of CPM, statistics, and EVM (it points to companion handbooks); aerospace/space-flight-centric; anchored to the 2024 second edition.

The English summary is being prepared. Showing the original description.

Reads one spreadsheet, CSV export or pasted table together with the user's question and drafts an insight pack: a data profile, observations cited to named columns and values and framed as leads, caveats, and suggested charts and follow-up analyses. Every figure carries the label "as read, verify in source"; correlation is never stated as causation. Use when the user asks to "profile this spreadsheet", "what does this data say", "find anomalies in this extract", "give me a first read on this CSV" or "summarise this table". Do not use for a purchase order log or spend extract, use purchase-order-anomaly-review instead; for actuals versus budget, use budget-variance-explainer instead; for a report that arrives by email on a schedule, use report-attachment-analyzer instead. Drafts for human review; never approves, authorises or signs off.

The English summary is being prepared. Showing the original description.

Use when the user asks to "figure out where our direct traffic really comes from", "measure dark social", "add a how-did-you-hear-about-us field", or "show social drives signups without click data"; produces a share-link/UTM hygiene spec for owned share surfaces, a self-reported attribution field design that replaces an existing form field (free-text first, coded later), a GA4 direct-traffic decomposition read (deep-URL directs, mobile-app skew, private-push correlation) with every derived number hard-labeled Estimated/proxy, and a branded-search-lift proxy from GSC plus Wikipedia pageviews — the declared dark-social method behind ECHO O2. Not for paid-channel attribution reconciliation (platform-claimed vs analytics conversions) — use attribution-reconciler. 暗社交归因/直接流量分解/自报来源字段/分享链路UTM

The English summary is being prepared. Showing the original description.

CLI documentation conventions for generated skills. Use when improving Commander descriptions, help text, positional argument docs, and config-surface correlation.

The English summary is being prepared. Showing the original description.

Designs and reviews production observability for mobile apps on every stack — Flutter, native Android, native iOS, React Native and Kotlin Multiplatform. Covers crash and error reporting with usable context, breadcrumbs, structured logs, traces and custom metrics, release and cohort segmentation, correlation with backend requests, alerting thresholds, sampling and cost, and what must never be collected. Use when production problems cannot be explained from the available data, when setting up crash reporting or telemetry, or when defining release health alerts.

The English summary is being prepared. Showing the original description.

Expert en croissance data-driven (experimentation, metrics, dashboards, correlation analysis)

The English summary is being prepared. Showing the original description.

Quantify periodicity in a recorded agent session — dominant onset period in seconds, spectral entropy, autocorrelation lag. Use to prove a poll loop, measure how metronomic retries are, compare cadence between runs, or window into one suspicious stretch.

The English summary is being prepared. Showing the original description.

Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty Bul:ing correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.

The English summary is being prepared. Showing the original description.

tespit etme
lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

The English summary is being prepared. Showing the original description.

tespit etme (s) and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including AP...

The English summary is being prepared. Showing the original description.

Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.

The English summary is being prepared. Showing the original description.

Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.

The English summary is being prepared. Showing the original description.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

The English summary is being prepared. Showing the original description.

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

The English summary is being prepared. Showing the original description.

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.

The English summary is being prepared. Showing the original description.

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

The English summary is being prepared. Showing the original description.

Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.

The English summary is being prepared. Showing the original description.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

The English summary is being prepared. Showing the original description.

General Signals scout for PostHog projects. Cross-product explorer that scans a team's project and emits findings into the Signals inbox. Sibling signals-scout-* specialists each watch a single product surface in depth; this scout looks for cross-product correlations and explores the surfaces no specialist covers. Each scout runs on its own schedule (default hourly), so general fires independently of the specialists over time.

The English summary is being prepared. Showing the original description.

End-to-end post-GWAS causal inference pipeline orchestrating heritability partitioning, genetic correlation, Mendelian randomization with CHP-aware sensitivity (CAUSE / LHC-MR), colocalization, fine-mapping with SuSiE / FOCUS, mediation, TWAS triangulation, cis-pQTL drug-target MR, effector-gene prioritization (L2G / PoPS / cS2G), and GenomicSEM common-factor GWAS. Use when triangulating causal inference across multiple complementary methods, prioritizing tissues via stratified LDSC, nominating or de-risking drug targets, mapping a lead SNP to a candidate effector gene, modeling shared genetic architecture across correlated traits, or producing a STROBE-MR-compliant publication-grade evidence battery from GWAS summary statistics.

The English summary is being prepared. Showing the original description.