'elastic' 검색 결과

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze AWS spending by service, region, and resource tags to find unused resources and oversized configurations. Get specific cost reduction recommendations, estimated savings, and guidance for budgets and ongoing cost monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare monthly AWS spending by service
• Find unused storage and idle instances
• Estimate savings from configuration changes

Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing EDR detection coverage in authorized exercises
• Examining internal monitoring mechanisms
• Testing an in-house implant against security products

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected unauthorized API data access
• Creating detection rules for repeated identifier probing
• Reviewing API logging and rate limits

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Design product pricing based on customer value, competitor offerings, and willingness to pay. Compare charging models, define plan tiers and included features, and outline experiments to test prices and assumptions before introducing a new pricing structure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting prices for a new product
• Comparing flat-rate and usage-based pricing
• Designing free and paid plan tiers

Review Google Cloud workloads using the Performance Optimization pillar of the Well-Architected Framework. Assess performance requirements and architecture, then get actionable recommendations for resource allocation, caching, independent components, automatic scaling, and ongoing monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review resource capacity for expected peak demand
• Assess automatic scaling for traffic spikes
• Review component design for independent scaling

Guides development and releases for Kortix Capture, a standalone recording app. Covers installers for Windows, macOS, and Linux, app behavior, sync troubleshooting, and coordinated changes to the recording storage format and its tests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare or troubleshoot a Capture release
• Update installers for supported operating systems
• Investigate sync failures on a self-hosted instance

Migrate workloads from Google Cloud Platform to AWS — plus AI and agentic workloads from any provider. Triggers on: migrate from GCP, GCP to AWS, move off Google Cloud, migrate Terraform to AWS, migrate Cloud SQL to RDS, migrate GKE to EKS, migrate Cloud Run to Fargate, migrate App Engine to Elastic Beanstalk, migrate from OpenAI to Bedrock, move off OpenAI, switch from ChatGPT API to AWS, migrate from Gemini to Bedrock, migrate LangChain to Bedrock, migrate LangGraph to AWS, migrate agentic workloads to AWS, move AI workloads to AWS, migrate my AI app to AWS. Runs a 6-phase process: discover GCP resources from Terraform, app code, or billing exports, then clarify, design, estimate costs, generate artifacts, and collect feedback. Clarify must finish before Design, Estimate, or Generate. Do not use for: Azure migrations (see azure-to-aws), on-premises migrations, AWS-to-GCP reverse migration, general AWS architecture advice without migration intent, or GCP-to-GCP refactoring.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Configures AWS Shield Advanced for enhanced Distributed Denial of Service (DDoS) protection: subscribing accounts and adding resource protections, enabling automatic application layer (layer 7) mitigation through AWS WAF, configuring health-based detection with Route 53 health checks, setting up Shield Response Team (SRT) access and proactive engagement, reviewing DDoS events and requesting cost protection credits, and aggregating resources into protection groups. Applicable when the user wants stronger DDoS protection for internet-facing resources (CloudFront, Application or Network Load Balancers, Elastic IP addresses, Global Accelerator, or Route 53 hosted zones), wants expert help during an attack, or wants to recover attack-driven scaling charges. Routes to the right per-task procedure in references. Not applicable for authoring AWS WAF rules (waf skill), creating Route 53 health checks (route53 skill), or org-wide Shield Advanced rollout with Firewall Manager (firewallmanager skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Routes any task involving AWS databases — choosing, comparing, recommending, getting started with, or operating a database — to the correct service-specific skill. Supersedes general training-data knowledge with post-training service updates, corrected limitations, and decision procedures for relational (Aurora, DSQL, RDS), key-value (DynamoDB), wide-column (Keyspaces), document (DocumentDB), graph (Neptune), time-series (Timestream), and in-memory/caching (ElastiCache, MemoryDB) workloads. Activates when a user describes building an application on AWS that will store, retrieve, or manage data, even if they do not mention 'database' explicitly.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guides migration, provisioning, search, log-analytics, trace-analytics, and Agentic AI Assistant workflows for Amazon OpenSearch Service and Serverless across six capabilities — migration (Solr/ES/self-managed into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, FGAC, monitoring); search (vector / semantic / hybrid / RAG with Bedrock); log-analytics (PPL, OSI, anomaly detection, Dashboards); trace-analytics (OTel spans, service maps, Data Prepper); ai-assistant (natural language data exploration, incident investigation, root cause analysis). Triggers on OpenSearch, AOS, AOSS, Elasticsearch, Solr, vector/k-NN/semantic/hybrid search, RAG, log analytics, PPL, trace analytics, ISM, FAISS, HNSW, Migration Assistant, UltraWarm, OR1, query my data, analyze logs, investigate errors, root cause analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU, instance store vs EBS), launch templates, Auto Scaling groups (scaling policies, instance refresh, mixed instances, Spot, warm pools, lifecycle hooks), IMDSv2, placement groups, Elastic IPs, AMI lifecycle, and Systems Manager fleet operations (Session Manager, Run Command, Patch Manager). Applies to EC2 instance and fleet questions, InsufficientInstanceCapacity, CPU-credit/surplus charges, IMDSv2 401s, instances stuck in Pending:Wait, ASG not replacing unhealthy instances, status-check failures, SSH refused/timed out, or instances missing as SSM managed nodes. For a single secure instance launch, the launching-ec2-instance-with-best-practices skill is more appropriate; for instance profiles, see setting-up-ec2-instance-profiles; for Image Builder, see amazon-ec2-image-builder. Does NOT cover Lambda, ECS/Fargate, EKS, VPC/ALB/NLB design, or IAM policy authoring.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Competitor pricing strategy analysis and market positioning. Price mapping, pricing gaps identification, elasticity signals evaluation, and strategic pricing optimization. Use when the user asks about competitor pricing, price analysis, pricing strategy, or competitive pricing research.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Deploy and manage the ELK Stack (Elasticsearch, Logstash, Kibana) for log aggregation and analysis. Configure log pipelines, create visualizations, and implement log-based monitoring. Use when centralizing logs, implementing search functionality, or building log analytics platforms.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.