926 skills · sorted by relevance
Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.
Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.
Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.
Monitor public Certificate Transparency logs, which record TLS certificates, to spot unexpected issuance and discover subdomains. Use crt.sh data to maintain a certificate inventory, check domain findings against DNS, and configure alerts for suspicious activity.
Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.
Examine NTFS disk images for residual or hidden data beyond standard file recovery. Analyze file metadata, change records, unused space within allocated storage, and Alternate Data Streams to reconstruct available activity and identify suspicious timestamp differences.
Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.
Map intrusion evidence to the seven stages of the Lockheed Martin Cyber Kill Chain, a model of attack progression. Show where defenses worked or missed activity, and recommend prioritized controls that could interrupt attacks earlier.
Investigate compromised Docker containers by preserving evidence and examining image layers, logs, file changes, and host settings. Summarize suspicious activity, security configuration issues, and vulnerability findings to support incident response.
Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.
Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.
Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.
Use SAELens to train and analyze sparse autoencoders, which separate neural network activity into features that may represent recognizable concepts. Explore pretrained features, evaluate reconstruction quality, and investigate how individual features influence language model outputs.
Store conversations, agent activity, and feedback in cognee sessions, then carry them into long-term memory. This skill explains improve(), its processing stages, result statuses, and settings for diagnosing skipped work or controlling automatic runs.
Research a contact in Common Room using an email, social handle, or name. Bring together available background, activity, website visits, and company context, then suggest conversation starters supported by actual engagement signals.
Draft personalized sales emails, call scripts, and LinkedIn messages using Common Room activity data and recent public news. Each draft connects a specific prospect signal to the outreach, with notes explaining the chosen angle and any assumptions.
Build targeted company and contact lists with Common Room's Prospector. Refine criteria through conversation, distinguish new companies from existing accounts, and prioritize existing accounts using available activity signals and scores.
Keep customer records and sales deals current using emails, meetings, and call transcripts. Prepare activity summaries, follow-up drafts for quiet deals, cleanup proposals, and a next-step queue with owners and dates.
Review sales opportunities for warning signs such as inactivity, slipping close dates, contact changes, and renewal windows. Receive a short digest of triggered alerts, supporting evidence, and suggested actions, organized by what needs attention today or this week.
Compare assigned work from connected trackers with TASKS.md, review stale tasks, and fill gaps in stored context about people and projects. An optional comprehensive scan finds possible missed commitments in recent activity, with changes confirmed by the user.
Turn project or team updates into a structured report for leaders and stakeholders. The skill summarizes key metrics, accomplishments, ongoing work, risks, decisions needed, and next-period priorities, with an overall assessment of whether work is on track.
Install a local NanoClaw dashboard to inspect agents, sessions, channels, messages, and users. It displays token usage, context usage, activity, and live logs using periodic data snapshots and a log forwarding module.
Operate native apps on macOS, Windows, and Linux using identified controls, menu paths, or screen coordinates. Target a specific window, verify the result after each action, and consult available recent activity when resuming work.
Investigate hidden attacker activity using focused hypotheses, indicators of compromise such as malicious domains, and statistical checks on logs. Rank investigation priorities, generate indicator sweep targets, and flag unusual behavior for human review.