Packs
2 packs@dotnet
Dotnet Diag
Skills for .NET performance investigations, debugging, and incident analysis.
7 skills · pack
@testdouble
Han Atlassian
Atlassian-facing extensions to the Han suite. Adds markdown-to-confluence, which publishes a local Markdown file to a user-specified Confluence page; project-documentation-to-confluence, which runs the han-documentation project-documentation skill and then publishes the result there; investigate-to-confluence, which runs the core investigate skill and publishes the resulting investigation report t
6 skills · pack
Results for “investigation”
40 skills
mukul975 performing-log-analysis-for-forensic-investigation
Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.
24.6k · bundle
mukul975 implementing-cloud-trail-log-analysis
Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.
24.6k · bundle
mukul975 performing-disk-forensics-investigation
Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.
24.6k · bundle
mukul975 performing-endpoint-forensics-investigation
Conducts digital forensics investigations on compromised endpoints, including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction for incident response and evidence collection.
24.6k · bundle
oracle oke-troubleshooter
Diagnose and root-cause issues with OCI Kubernetes Engine clusters and workloads through evidence-driven investigation.
736 · bundle
mukul975 analyzing-browser-forensics-with-hindsight
Extract and analyze Chromium-based browser artifacts using Hindsight to reconstruct user web activity for forensic investigations.
24.6k · bundle
More results
mukul975 implementing-soar-playbook-for-phishing
Automate phishing incident response by creating Splunk SOAR containers, adding artifacts, and triggering investigation playbooks.
24.6k · bundle
mukul975 performing-cloud-forensics-investigation
Collect and analyze logs, snapshots, and metadata from AWS, Azure, and GCP to investigate security breaches in cloud environments.
24.6k · bundle
mukul975 analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
24.6k · bundle
mukul975 extracting-credentials-from-memory-dump
Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
24.6k · bundle
mukul975 performing-malware-persistence-investigation
Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.
24.6k · bundle
mukul975 analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
24.6k · bundle
mukul975 performing-network-traffic-analysis-with-zeek
Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic investigation.
24.6k · bundle
zhaoxuya520 digital-forensics
Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.
12.8k · bundle
mukul975 performing-cloud-log-forensics-with-athena
Query AWS CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena for forensic investigation of security incidents.
24.6k · bundle
mukul975 building-incident-timeline-with-timesketch
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
24.6k · bundle
mukul975 analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
24.6k · bundle
mukul975 performing-insider-threat-investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.
24.6k · bundle
mukul975 investigating-phishing-email-incident
Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.
24.6k · bundle
mukul975 performing-active-directory-compromise-investigation
Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.
24.6k · bundle
mukul975 performing-threat-hunting-with-elastic-siem
Proactively search for threats in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection.
24.6k · bundle
mukul975 analyzing-docker-container-forensics
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
24.6k · bundle
mukul975 analyzing-ransomware-payment-wallets
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution.
24.6k · bundle
mukul975 analyzing-usb-device-connection-history
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
24.6k · bundle
mukul975 investigating-insider-threat-indicators
Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation.
24.6k · bundle
mukul975 investigating-ransomware-attack-artifacts
Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
24.6k · bundle
mukul975 extracting-browser-history-artifacts
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
24.6k · bundle
rulebase-co cx-dispute-quality
Use to audit how payment disputes, chargebacks and unrecognised-transaction claims are handled against scheme deadlines and evidence standards. Trigger for "audit our dispute handling", "chargeback quality review", "are we meeting scheme deadlines", unrecognised transaction claims, provisional credit decisions, or a customer complaining their dispute was rejected unfairly.
1
bankrbot sleuth-ai
Investigate tokens, wallets, and on-chain entities with natural-language answers backed by on-chain data. Detect insiders, whales, pump-and-dump, wash trading, and wallet networks on Base.
1.2k · bundle
mukul975 analyzing-windows-amcache-artifacts
Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations.
24.6k · bundle
mukul975 conducting-phishing-incident-response
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages, and remediating affected accounts.
24.6k · bundle
mukul975 analyzing-linux-audit-logs-for-intrusion
Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.
24.6k · bundle
mukul975 hunting-for-suspicious-scheduled-tasks
Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns.
24.6k · bundle
mukul975 analyzing-malware-sandbox-evasion-techniques
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction detection, and sleep inflation patterns from Cuckoo/AnyRun behavioral reports.
24.6k · bundle
cloudthinker-ai aws-cloudtrail
Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.
7
mukul975 performing-linux-log-forensics-investigation
Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.
24.6k · bundle