918 skills · sorted by relevance
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
The English summary is being prepared. Showing the original description.
Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.
The English summary is being prepared. Showing the original description.
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
The English summary is being prepared. Showing the original description.
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
The English summary is being prepared. Showing the original description.
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
The English summary is being prepared. Showing the original description.
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
The English summary is being prepared. Showing the original description.
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.
The English summary is being prepared. Showing the original description.
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.
The English summary is being prepared. Showing the original description.
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
The English summary is being prepared. Showing the original description.
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
The English summary is being prepared. Showing the original description.
Reviews one deal's notes and timeline (CRM opportunity record, activity log, emails, meeting notes, forecast entries) for risk signals such as a single contact thread, no identified budget owner, slipped or missing dates, silence after a proposal, an undefined decision process or a competitor named late, and returns a DRAFT risk register: each signal with the quoted evidence and its date, a severity on a stated scale, and one proposed next action with an owner role for the user to decide on. Use when the user asks to "review the risks on this deal", "why is this opportunity stalling", "is this deal single-threaded", "deal health check before the forecast call" or "what should we do next on <opportunity>". Do not use for a whole-account plan, use account-plan-builder instead; for scoring early leads against a rubric use lead-qualification-scorer. Drafts for human review; never approves, authorises or signs off.
The English summary is being prepared. Showing the original description.
Proposes redactions of personal identifiers in pasted text or an attached document (names, contact details, identification and account numbers, dates that identify, quasi-identifiers) and returns a DRAFT redacted copy with consistent placeholder tokens plus a redaction table stating what was replaced, where and why, with a confidence level and a blank reviewer decision per row. Use when the user asks to "redact the names in this document", "de-identify this transcript before we share it", "strip personal data from these notes", "anonymise this report for publication" or "what would need redacting here". Do not use for assessing a planned processing activity, use dpia-draft-pack instead; do not use for working out what data an incident exposed, use data-incident-impact-brief instead. Never declares a document anonymised, safe to release or compliant. Drafts for human review; never approves, authorises or signs off.
The English summary is being prepared. Showing the original description.
Query the user's local and synced-device data via the screenpipe REST API at localhost:3030 — recordings, audio, UI, meetings, connected services, and memory. Use for screen activity, other-device or cross-device history, productivity, media export, connections, durable memory, or discovering and automating saved workflows.
The English summary is being prepared. Showing the original description.
Reconstruct a daily or weekly worklog from observed activity and outcomes.
The English summary is being prepared. Showing the original description.
Create a shareable recap of selected Screenpipe activity while minimizing private details.
The English summary is being prepared. Showing the original description.
IT要求・活動インパクトスコアの良い点・悪い点を分析し、改善点と改善のための問いを生成
The English summary is being prepared. Showing the original description.
IT要求・活動のインパクトスコアを算出
The English summary is being prepared. Showing the original description.
要求分析ツリーの活動を作成（Phase 4-3）
The English summary is being prepared. Showing the original description.
下位要素が存在しない業務要求に対してIT要求または活動を追加作成
The English summary is being prepared. Showing the original description.
検証結果に基づいてIT要求・活動インパクトスコアを洗練・修正する
The English summary is being prepared. Showing the original description.
活動の良い点・悪い点を分析し、改善点と改善のための問いを生成
The English summary is being prepared. Showing the original description.
活動を作る時の観点を説明する
The English summary is being prepared. Showing the original description.
検証結果に基づいて活動を洗練・修正する
The English summary is being prepared. Showing the original description.
IT要求・活動インパクトスコアの検証を行う時の観点を説明する
The English summary is being prepared. Showing the original description.