Results for “sentinel”

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Set up Slack alerts for a colony, a group of AI agents, so users can reply when work stalls. The skill prepares the Slack app, stores sending and receiving tokens, connects a channel, and tests notifications.

• Receiving Slack alerts when agent work stalls
• Replying from Slack to keep work moving
• Creating a dedicated notification channel

Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.

• Investigating suspicious Azure sign-ins
• Building Microsoft Sentinel detection rules
• Reviewing suspicious OAuth app consent

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Set up Telegram alerts for a colony, a group of AI agents, so users can respond when work stalls. The skill creates or reuses a bot, stores its token, connects the destination chat, and tests notifications.

• Receiving Telegram alerts when agent work stalls
• Replying from Telegram to keep work moving
• Setting up a notification bot and destination chat

Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.

The English summary is being prepared. Showing the original description.

Create threat detection rules in Sigma, a shared format for security log searches, and convert them for Splunk, Elastic, or Microsoft Sentinel. Validate syntax, test expected matches and false positives, and map coverage to MITRE ATT&CK.

• Turning threat reports into detection rules
• Reusing detection logic across SIEM platforms
• Testing rule matches and reducing false positives

Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.

• Investigating suspicious additions of application credentials
• Reviewing privileged roles assigned to application identities
• Building detection rules for Entra ID identity abuse

Capture production errors from Convex server functions and browser interfaces in your own deployment. Redact sensitive information before storage, inspect recent failures, monitor new events, and optionally route recurring errors into a workflow that opens fix pull requests.

• Collect server and browser errors in one deployment
• Inspect production failures with sensitive details redacted
• Monitor newly recorded errors

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

The English summary is being prepared. Showing the original description.

bu skill covers Dağıt:ing Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL Tespit queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

The English summary is being prepared. Showing the original description.

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

The English summary is being prepared. Showing the original description.

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

The English summary is being prepared. Showing the original description.

Wait for the next Convex development error, production error, or feature request, then respond with investigation, a fix, or implementation. The skill combines local logs and deployment events, using polling when blocking tools are unavailable.

• Waiting for the next error during development
• Investigating and fixing newly detected production errors
• Starting implementation when a feature request arrives

Expert knowledge for Azure Sentinel development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring data connectors, ASIM/analytics rules, KQL automation, data lake integrations, or CI/CD deployments, and other Azure Sentinel related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Monitor (use azure-monitor).

The English summary is being prepared. Showing the original description.

Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when building B2C user flows/custom policies, configuring IdPs/MFA, securing APIs, automating CI/CD, or monitoring with Sentinel, and other Azure Active Directory B2C related development tasks. Not for Azure Role-based access control (use azure-rbac), Azure Information Protection (use azure-information-protection), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel).

The English summary is being prepared. Showing the original description.

Audit any Supabase project for security vulnerabilities, RLS misconfigurations, exposed API keys, auth bypasses, and storage issues. Use this skill whenever the user mentions Supabase security, RLS policies, database security audit, security review, penetration testing a Supabase app, checking if their database is exposed, hardening their Supabase project, fixing RLS, or anything related to securing a Supabase or vibe-coded application. Also trigger when the user asks about securing apps built with Lovable, Bolt, Replit, Cursor, or any AI coding tool that uses Supabase as a backend. Even if the user just says 'is my app secure' or 'check my database' and their project uses Supabase, use this skill. (DEPRECATED: this skill is a backwards-compat shim. Prefer the multi-backend `database-sentinel` skill, which covers Supabase plus Firebase, MongoDB, self-hosted Postgres, and self-hosted MySQL.)

The English summary is being prepared. Showing the original description.

Dockerfile、Compose、Terraform、GitHub Actionsの危険設定を決定的な検出器で検査し、共通Finding schemaとredaction基準で返す。secretや一般の脆弱性はreviewerのsecurity観点を使う。明示的な `/sentinel-review` の指定でだけ使う。

The English summary is being prepared. Showing the original description.

Dockerfile・Compose・Terraform・GitHub Actionsの差分または指定パスを決定的な検出器で検査し、共通Finding schemaとredaction基準で結果を返す。IaCの危険設定検査専用で、secretや一般の脆弱性はreviewerのsecurity観点を使う。明示的な `/sentinel-review` の指定でだけ使う。

The English summary is being prepared. Showing the original description.

Use when asked to report the deployment sentinel value. Provides the sentinel string that proves a vendored skill reached the agent's context.

The English summary is being prepared. Showing the original description.

Investigate attacks that make legitimate Windows applications load malicious DLL files. This skill examines loading events, digital signatures, file hashes, and unusual locations, then checks process behavior to document suspicious cases and guide remediation.

• Investigating alerts about unsigned DLL files
• Hunting for persistent threats using legitimate applications
• Checking suspicious DLL loading paths

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

The English summary is being prepared. Showing the original description.

Expert knowledge for Azure Defender For Cloud development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when securing VMs/containers/storage/SQL, enabling plans, tuning alerts, exporting via APIs/ARG, or integrating SIEM/XDR, and other Azure Defender For Cloud related development tasks. Not for Azure Security (use azure-security), Azure Sentinel (use azure-sentinel), Azure DDoS Protection (use azure-ddos-protection), Azure External Attack Surface Management (use azure-external-attack-surface-management).

The English summary is being prepared. Showing the original description.