Security & Testing Agent Skills

Investigate USB device connection history from Windows registry, event

Parses and analyzes the Windows Amcache.hve registry hive to extract

Parse Windows LNK shortcut files to extract target paths, timestamps,

Parse Windows Prefetch files using the windowsprefetch Python library

Extract and analyze Windows Registry hives to uncover user activity,

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Auditing Terraform infrastructure-as-code for security misconfigurations

Automates the enrichment of raw indicators of compromise with multi-source

Build an automated system to track adversary infrastructure using passive

Build and configure a resilient command-and-control infrastructure using

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM

Build effective detection rules using Splunk Search Processing Language

Establish SAML 2.0 identity federation between on-premises Active Directory

Builds comprehensive identity governance and lifecycle management processes

Builds real-time incident response dashboards in Splunk, Elastic, or

Designs and documents structured incident response playbooks that define

Build collaborative forensic incident timelines using Timesketch to ingest,

Build an automated pipeline to defang indicators of compromise (URLs,

OpenCTI is an open-source platform for managing cyber threat intelligence