Results for “anomaly-detection”

Anomaly Detection Specialist IA — Expert en détection d'anomalies (statistique, ML, séries temporelles, alerting temps réel)

The English summary is being prepared. Showing the original description.

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Build normal traffic profiles for industrial control networks and identify unusual connections, polling intervals, and protocol operations. Use machine learning and process records to investigate deviations and produce anomaly reports with severity levels.

• Establishing normal traffic profiles for industrial networks
• Detecting unusual connections and polling intervals
• Investigating Nozomi Guardian or Dragos alerts

Monitor daily AWS spending by service and account, compare it with historical baselines, and send Slack alerts with cost differences and likely causes. Known planned increases are excluded, and cloud resources remain unchanged.

• Detecting unusual increases in daily AWS spending
• Investigating cost spikes by service and account
• Excluding planned or seasonal spending increases

Catches unusual performance changes across your accounts — CPC spikes, CVR drops, spend surges, impression collapses, CTR shifts — and flags them with context about what likely changed. The goal is to catch problems in hours instead of discovering them days later during a routine check. Platform: Google and Meta.

The English summary is being prepared. Showing the original description.

Industrial AI literature research with mandatory intake questions, venue-aware source prioritization, structured report outputs, and survey draft generation. Use when the user needs up-to-date research on predictive maintenance, intelligent scheduling, industrial anomaly detection, smart manufacturing, cyber-physical systems, edge AI for automation, or crossover robotics-for-industry topics. Also trigger for adjacent terms: "digital twin", "industrial IoT", "Industry 4.0", "manufacturing AI", "factory automation", "process optimization", or "survey draft" in industrial contexts.

The English summary is being prepared. Showing the original description.

Investigate outliers, rare events, spikes, and suspicious records in datasets. Use as an explicit anomaly-analysis helper when you want concrete anomaly-detection workflow guidance, not generic data validation or end-to-end ML ownership.

The English summary is being prepared. Showing the original description.

Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel

The English summary is being prepared. Showing the original description.

Use anomalib for anomaly-detection install, data/model selection, training and evaluation, deployment and inference, and benchmark pipelines.

The English summary is being prepared. Showing the original description.

Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.

The English summary is being prepared. Showing the original description.

基于阈值检测时间序列中的显著异常波动点。当需要找出指标异常波动日期、识别数据异动时调用。

The English summary is being prepared. Showing the original description.

Design and operate a data integrity monitoring programme based on ALCOA+ principles. Covers detective controls, audit trail review schedules, anomaly detection patterns (off-hours activity, sequential modifications, bulk changes), metrics dashboards, investigation triggers, and escalation matrix definition. Use when establishing a data integrity monitoring programme for GxP systems, preparing for inspections where data integrity is a focus area, after a data integrity incident requiring enhanced monitoring, or when implementing MHRA, WHO, or PIC/S guidance.

The English summary is being prepared. Showing the original description.

Implement AI-powered anomaly detection for operational metrics using time series analysis (Isolation Forest, Prophet, LSTM), alert correlation, and root cause analysis. Reduce alert fatigue by intelligently identifying true anomalies in system metrics, logs, and traces. Use when operations teams are overwhelmed by alert volume, when detecting complex multi-metric anomalies beyond static thresholds, when seasonal patterns make thresholds ineffective, or when needing to predict issues proactively before they impact users.

The English summary is being prepared. Showing the original description.

Hunts for unusual outbound network connections by flagging direct-to-IP traffic, uncommon ports, rare destinations, high data-egress ratios, and connections from unexpected processes in network telemetry. Activates for requests to hunt unusual outbound traffic, detect suspicious egress, or find anomalous external connections.

The English summary is being prepared. Showing the original description.

Establishes behavioral baselines from historical telemetry (process, network, or logon events) so hunts can flag rare and first-seen activity instead of relying on static signatures. Activates for requests to build a telemetry baseline, find rare or first-seen activity, or compute frequency baselines for anomaly hunting.

The English summary is being prepared. Showing the original description.

Use for sensemaking, frame revision, anomaly handling, questioning strategy, and ambiguity diagnosis with the Data/Frame model before action is chosen. NOT for deterministic classification, settled execution planning, or situations where the frame is already stable.

The English summary is being prepared. Showing the original description.

Great Expectations, dbt tests, anomaly detection, and data contracts for data quality. Activate on: data quality, data validation, Great Expectations, data contract, anomaly detection, SLA, freshness check, schema validation. NOT for: dbt model structure (use dbt-analytics-engineer), schema evolution (use schema-evolution-manager).

The English summary is being prepared. Showing the original description.

Detect anomalies in procurement data using Qdrant vector operations. Covers centroid-based outlier detection, near-duplicate finding via batch recommend, amount z-score analysis, and vendor variance scoring. Use when building anomaly detection, fraud detection, or data quality features.

The English summary is being prepared. Showing the original description.

Deploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.

The English summary is being prepared. Showing the original description.

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.

The English summary is being prepared. Showing the original description.