Security & Testing Agent Skills for Microsoft Copilot

Auditing Microsoft Entra ID (Azure Active Directory) configuration to

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Auditing Terraform infrastructure-as-code for security misconfigurations

Automates the enrichment of raw indicators of compromise with multi-source

Build an automated system to track adversary infrastructure using passive

Build and configure a resilient command-and-control infrastructure using

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM

Build effective detection rules using Splunk Search Processing Language

Establish SAML 2.0 identity federation between on-premises Active Directory

Builds comprehensive identity governance and lifecycle management processes

Builds real-time incident response dashboards in Splunk, Elastic, or

Designs and documents structured incident response playbooks that define

Build collaborative forensic incident timelines using Timesketch to ingest,

Build an automated pipeline to defang indicators of compromise (URLs,

OpenCTI is an open-source platform for managing cyber threat intelligence

Build structured communication templates for malware incidents including

Builds a structured ransomware incident response playbook aligned with

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners,

Apply bottom-up and top-down role mining techniques to discover optimal

Build a structured SOC escalation matrix defining severity tiers, response