Design and assess security monitoring that can surface an attack in progress. Decide which logs to retain, build detections around attacker behavior, reduce noisy alerts, define response steps, and verify that alerts reach someone who can act.
Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens when something fires. Use this to design or assess monitoring coverage, work out why an incident went unnoticed, cut alert volume without losing signal, or decide what a detection capability should cost.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Incident response assumes someone noticed. Most organizations that respond well to incidents found out from a customer, a vendor, or an extortion note, and the gap between compromise and discovery is where nearly all of the damage accumulates.
Work backwards from the questions an investigation asks: who authenticated, from where, and what did they then do. That points at a short list that matters far more than volume.
Retention decides whether you can investigate at all. Intrusions are commonly discovered months after entry, so logs kept for thirty days answer none of the useful questions. Split it: a short hot window you can search fast, and a longer cold archive you can still reach.
Logs stored only on the system that produced them are logs the attacker controls. Ship them off the host as they are written, to a destination with different credentials from the systems it collects from — otherwise one compromised administrator account ends both the intrusion and the evidence of it.
A single event is almost never an incident. What distinguishes an attacker is a sequence: authentication from a new location, followed by a mailbox rule creation, followed by a bulk download.
Every detection needs a documented response. A detection that fires with no defined next step becomes noise on its second occurrence.
An alert that is wrong most of the time trains people to close it without reading. The team stops noticing, and the eventual real one closes the same way.
Measure the proportion of alerts that are actually actioned. Anything consistently below roughly half is a tuning problem, and the fix is narrowing or suppressing the rule rather than adding another analyst. A smaller number of trustworthy detections beats broad coverage nobody believes.
Coverage hours are an explicit decision with a cost. Business-hours monitoring means an intrusion starting on Friday evening runs unobserved for two days, which is exactly why attacks are timed that way. If you cannot staff around the clock, say so, and choose a small number of detections that page a human at any hour rather than pretending the queue is monitored.
Outsourcing detection is legitimate and does not outsource the decision. The provider escalates; someone inside still has to be reachable and authorized to disconnect something.
Detection coverage is assumed far more often than it is verified. Run the behavior — a benign version of the technique — and confirm the alert arrives, reaches a person, and carries enough context to act on. Coverage claimed from a configuration page is not coverage.
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Design and review access so people and services have appropriate permissions. Use it to plan roles, audit accounts, reduce always-on admin rights, manage credentials, handle departures, and improve sign-in with single sign-on or multi-factor authentication.
Plan account-based marketing for a defined set of companies. Assess whether the economics fit, prioritize accounts, map the people involved in buying, coordinate outreach across sales and marketing, and track account movement through the pipeline.
Improve the path from signup to a new user’s first meaningful result. Define the action that signals real value, refine signup and onboarding, and diagnose where people drop off so more accounts become active users sooner.
Design a repository’s multi-agent structure by assigning exclusive file areas, defining builder and reviewer roles, and checking ownership rules with a CI script. Use it to divide work, prevent overlapping edits, and decide whether another agent is needed.
Use this skill to define an AI system’s intended use, evaluate its errors across user groups, plan monitoring and meaningful human review, and document its limits. It supports deployment and retirement decisions, especially when AI could affect consequential outcomes for people.
Use this skill to analyze markets, map competitors, assess trends, and compare strategic options such as market entry or build versus buy. It produces a cited research brief that separates established facts from inferences and estimates, states confidence, and connects findings to a decision.