Debugging

Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS

'Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and

'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security

Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its

Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary

Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls

'Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for gathering, sharing,

Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory,

'Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment,

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce

'Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for

'Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed

'Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing

'Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom

'Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT

'This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems

Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis

Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel

'This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection