Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md

@@ -0,0 +1,108 @@
+# API Reference: Beaconing Detection via Frequency Analysis
+
+## Beaconing Characteristics
+
+| Characteristic | Description |
+|---------------|-------------|
+| Regular intervals | Connections at fixed time periods |
+| Low jitter | Small variance in intervals |
+| Persistent | Continues over hours/days |
+| Consistent size | Similar packet sizes |
+
+## Jitter Calculation
+
+### Standard Deviation of Intervals
+```python
+import math
+intervals = [t[i+1] - t[i] for i in range(len(t)-1)]
+mean = sum(intervals) / len(intervals)
+variance = sum((x - mean)**2 for x in intervals) / len(intervals)
+jitter = math.sqrt(variance)
+jitter_percent = (jitter / mean) * 100
+```
+
+### Jitter Thresholds
+| Jitter % | Confidence | Likely Cause |
+|----------|------------|--------------|
+| < 5% | HIGH | Automated C2 beacon |
+| 5-15% | MEDIUM | Possible C2 with sleep jitter |
+| 15-30% | LOW | May be legitimate polling |
+| > 30% | NONE | Likely human/random |
+
+## Zeek conn.log Format
+
+### Fields
+| Index | Name | Description |
+|-------|------|-------------|
+| 0 | ts | Unix timestamp |
+| 2 | id.orig_h | Source IP |
+| 3 | id.orig_p | Source port |
+| 4 | id.resp_h | Destination IP |
+| 5 | id.resp_p | Destination port |
+| 6 | proto | Protocol |
+| 9 | orig_bytes | Sent bytes |
+| 10 | resp_bytes | Received bytes |
+
+## RITA (Real Intelligence Threat Analytics)
+
+### Analyze Zeek Logs
+```bash
+rita import /path/to/zeek/logs dataset_name
+rita show-beacons dataset_name
+```
+
+### Output Columns
+| Column | Description |
+|--------|-------------|
+| Score | Beacon probability (0-1) |
+| Source | Source IP |
+| Destination | Destination IP |
+| Connections | Total connections |
+| Avg Bytes | Average data transfer |
+
+## Splunk SPL — Beacon Detection
+
+```spl
+index=network sourcetype=zeek:conn
+| bin _time span=60s
+| stats count by src_ip, dest_ip, dest_port, _time
+| streamstats window=100 stdev(count) as jitter avg(count) as avg_count by src_ip, dest_ip
+| where jitter/avg_count < 0.15
+| stats count as beacon_count by src_ip, dest_ip, dest_port
+| where beacon_count > 100
+```
+
+## Elastic SIEM — Beacon Detection
+
+```json
+{
+  "query": {
+    "bool": {
+      "must": [
+        {"range": {"@timestamp": {"gte": "now-24h"}}},
+        {"exists": {"field": "destination.ip"}}
+      ]
+    }
+  },
+  "aggs": {
+    "by_flow": {
+      "composite": {
+        "sources": [
+          {"src": {"terms": {"field": "source.ip"}}},
+          {"dst": {"terms": {"field": "destination.ip"}}}
+        ]
+      }
+    }
+  }
+}
+```
+
+## Common C2 Beacon Intervals
+
+| Framework | Default Interval |
+|-----------|-----------------|
+| Cobalt Strike | 60 seconds |
+| Metasploit | 5 seconds |
+| Empire | 5 seconds |
+| Covenant | 10 seconds |
+| Sliver | 60 seconds |