Results for “endpoint”

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

• Investigating suspicious use of built-in Windows utilities
• Creating Sigma rules for unusual command arguments
• Finding Office apps that launch unexpected system utilities

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.

• Monitoring shared drives and NAS for suspicious file changes
• Adding decoy file monitoring alongside endpoint protection
• Testing incident response with decoy file triggers

Investigate security incidents in IBM QRadar SIEM by connecting events across network, endpoint, and application logs. Build search queries and correlation rules, adjust false positive filters, and create dashboards to track investigation activity.

• Investigating events grouped into QRadar offenses
• Detecting successful logins after repeated failures
• Tuning rules that generate false positives

Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.

• Adding ransomware warning files to shared folders
• Supplementing endpoint protection with decoy file monitoring
• Testing alerts triggered by decoy file changes

Contain an active security breach by isolating endpoints, blocking attacker communications, and revoking compromised access. Follow procedures to limit spread between systems, preserve evidence, verify containment, and report remaining risks and business impact.

• Contain ransomware spreading between servers
• Revoke access through compromised accounts
• Isolate hosts communicating with attacker infrastructure

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Build an automated workflow that collects suspicious files, checks known malware records, and submits unknown samples to isolated analysis environments. Generate verdicts and indicators of compromise, then send results to security monitoring systems.

• Automating analysis of quarantined email attachments
• Batch-processing files quarantined by endpoint security
• Extracting threat indicators during incident investigations

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Turn API code into documentation covering endpoints, inputs, authentication, responses, and errors. Add request examples in multiple languages and usage guides to help developers understand and start using the API.

• Writing documentation for a new API
• Updating API documentation after code changes
• Preparing API guides for new developers or external users

Implement Zoom webhooks, HTTP notifications sent when events occur, such as meetings starting or recordings becoming available. Use reference guidance for event selection, subscriptions, signature verification, endpoint validation, delivery handling, and retries.

• Receiving notifications when cloud recordings are ready
• Choosing meeting and participant events to subscribe to
• Implementing webhook signature verification

Build server-side Zoom integrations for meeting scheduling, user management, and recording downloads. This reference guides API endpoint selection, OAuth authentication, request limits, and error diagnosis, with examples for automated workflows and event notifications.

• Automating meeting creation and updates
• Managing Zoom users in bulk
• Downloading recordings after event notifications

Find and retrieve official OpenAI documentation to answer API integration questions with source evidence. Check endpoint definitions, parameters, and documented limits, and receive setup guidance when the documentation connection is unavailable.

• Verify specifications before integrating an OpenAI API
• Check endpoint parameters and schemas
• Support technical explanations with official documentation

Explore local or remote repositories with Repomix CLI to understand their structure, locate related code across files, and review file counts and estimated tokens, the units AI models use to process text.

• Understanding an unfamiliar project's structure
• Locating authentication code and API endpoints
• Checking file counts and estimated AI tokens

Compare application pages, interactive components, API endpoints, and key user journeys with existing tests. Get a coverage matrix, an estimated coverage percentage, and a prioritized plan for missing tests with suggested templates and effort estimates.

• Finding untested pages, components, and API endpoints
• Prioritizing tests for sign-in, payments, and core features
• Planning test counts, templates, and effort for coverage gaps

Review REST API specifications with automated checks for inconsistent conventions and breaking changes—changes that disrupt existing clients. Get a design grade, improvement recommendations, and tool reports to support release reviews and API migrations.

• Reviewing a pull request that changes API endpoints
• Checking compatibility before an API version migration
• Establishing shared API design standards

Manage machine learning models and their versions in the Agent Platform Model Registry. List registered models, inspect details, upload new versions, update names or descriptions, and delete models through workflows that require confirmation for changes.

• List registered models and inspect their details
• Register a new model or model version
• Update a model's display name or description

Build Next.js applications with App Router, the app directory routing system. Get guidance on server rendering, data fetching, caching, API endpoints, and deployment settings, including loading states and image optimization for responsive page experiences.

• Designing pages and shared layouts with App Router
• Configuring data caching and revalidation
• Implementing forms and API endpoints

Prepare SageMaker deployments and training by finding existing execution roles, checking trust settings, and reviewing required permissions. Guides role creation only when necessary and identifies permission issues that require an AWS administrator.

• Check execution roles before deploying a SageMaker endpoint
• Find an existing role when no ARN is provided
• Investigate IAM AccessDenied errors

Manage Hugging Face Hub through the hf command line tool. Download and upload models or datasets, organize cloud storage, manage authentication and local caches, run scheduled jobs, and deploy or maintain model inference services.

• Download or publish models and datasets
• Sync training checkpoints to cloud storage
• Inspect and clean the local cache

Create reference documentation directly from source code for public functions, classes, command-line commands, and endpoints. Organize parameters, defaults, return values, errors, and runnable examples, then check that the documentation matches the implementation.

• Writing reference docs for a public module
• Documenting command-line arguments and defaults
• Adding minimal usage examples for an API

Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.

• Reviewing order and payment workflow integrity
• Testing concurrent coupon redemption or transfers
• Assessing JWT validation and GraphQL controls