'monitoring' 검색 결과

Track when assets begin moving together, assess the resulting loss of diversification, and examine which assets moved first during a crisis. Rank changes in asset relationships and report uncertainty explicitly for risk monitoring and retrospective analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitoring when assets start moving as one group
• Reporting reduced portfolio diversification
• Examining which assets moved first during a crisis

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating anomalous token usage alerts
• Responding to suspected session hijacking
• Finding token reuse in sign-in logs

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Investigate malicious code placed inside legitimate Windows processes using memory analysis, event logs, and API monitoring. Identify injection methods, examine extracted code, and produce evidence reports and detection rules for suspicious process behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unexpected connections from legitimate processes
• Finding injected code in memory dumps
• Classifying process hollowing and other injection methods

Investigate excessive privileges inside Kubernetes pods by reviewing security settings, runtime events, and audit logs. Use admission policies to restrict risky configurations and Falco monitoring to detect suspicious privilege changes and container activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding pods running as root or in privileged mode
• Reviewing host filesystem access and dangerous Linux permissions
• Detecting privilege changes while containers are running

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding unexpected binaries executed inside running containers
• Investigating package installations and file changes at runtime
• Checking whether containers still match their approved images

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Build automated pipelines that collect threat indicators, such as malicious IP addresses and file hashes, from multiple feeds. Standardize formats, remove duplicates, assess confidence, and distribute indicators to security monitoring systems for matching and alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating threat feed ingestion
• Standardizing and deduplicating threat indicators
• Distributing indicators to multiple monitoring systems

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Build an automated workflow that collects suspicious files, checks known malware records, and submits unknown samples to isolated analysis environments. Generate verdicts and indicators of compromise, then send results to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating analysis of quarantined email attachments
• Batch-processing files quarantined by endpoint security
• Extracting threat indicators during incident investigations

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring