Mahipal

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Set up encrypted connections between devices with Tailscale and control access by user or device. The skill covers network routing, device name resolution, and self-hosting the coordination server with Headscale.

• Replacing a traditional VPN with Tailscale
• Restricting server access by team or device
• Connecting remotely to internal networks

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Design and validate rules that limit communication between servers and containers to necessary connections. The skill covers traffic mapping, label-based policies, staged enforcement, and checks for unauthorized movement between systems within a zero trust architecture.

• Planning communication rules for a zero trust network
• Separating production and development environments
• Restricting access to critical applications

Deploy Prisma Access to secure access to internal applications for remote users and branches. Configure connectors, GlobalProtect agents, access policies based on user groups and device security, and centralized logging through Strata Cloud Manager.

• Migrating VPN and branch security to Prisma Access
• Restricting internal app access by user and device
• Integrating access controls with existing Palo Alto NGFW systems

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Guide response to suspected or confirmed malware infections across enterprise endpoints. Identify the malware and entry route, assess affected systems, coordinate containment and removal, and document recovery checks, infection timelines, and observable signs of compromise.

• Investigating malware alerts from endpoint security tools
• Assessing infection spread across multiple endpoints
• Planning containment, removal, and endpoint recovery

Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.

• Combining findings from multiple security scanners
• Importing scan results automatically from CI/CD pipelines
• Connecting vulnerability findings to Jira tickets

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Build a repeatable process for Microsoft monthly security updates, from reviewing advisories and ranking vulnerabilities to testing, staged deployment, and verification. Helps teams set response deadlines based on risk and report remaining unpatched systems.

• Establishing a monthly Microsoft security update workflow
• Prioritizing vulnerabilities by exploitation risk
• Planning pilot and production deployment stages

Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.

• Building a Sliver server for an authorized red-team exercise
• Configuring multiple communication protocols for an exercise
• Managing certificate-based access for multiple operators

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.

• Standardizing exception requests for delayed vulnerability fixes
• Recording alternative protections and risk acceptance
• Checking expired exceptions and producing monthly reports

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Build dashboards and reports for security operations teams using incident and alert data. Track detection and resolution times, false alarms, analyst workload, and detection coverage to assess operational trends and the effects of improvement initiatives.

• Preparing monthly or quarterly security operations reports
• Reviewing analyst workload and shift staffing
• Comparing performance before and after tool adoption

Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.

• Reconstructing the sequence of an incident
• Reviewing evidence with multiple analysts
• Combining Plaso output and other logs

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Design a security operations center escalation matrix that defines incident priorities, response deadlines, analyst responsibilities, and notification paths. Use business impact, asset importance, and data sensitivity to decide when incidents need senior or management attention.

• Defining incident priorities and response deadlines
• Clarifying handoffs between analyst tiers
• Setting escalation rules for overdue incidents

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions