'incident-response' 검색 결과

Practical incident-response runbook for a suspected or confirmed ComfyUI / GPU-daemon compromise. Triage, scope, contain, forensic collection, weight-integrity verification, rebuild from clean snapshot, postmortem. NOT for hygiene scans on a healthy box (use supply-chain-defense-for-ml-extensions), and NOT for runtime hardening of a fresh deployment (use gpu-hosted-asset-hardening).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Build incident response dashboards that bring affected systems, containment progress, indicators of compromise, and response timelines into one view. Help security teams coordinate active incidents and prepare operational reports and executive briefings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Coordinating an active security incident
• Tracking affected systems and containment
• Reviewing response timelines after an incident

[omh] Production is down or an incident is open: command an incident that is still open -- severity as declared live state, commander and roles, an append-only timeline, a recorded temporary mitigation, verified recovery, and the customer notice. Use when the user says: live-incident-response, live incident response, incident response, active incident, ongoing incident, open incident, incident open, incident commander.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design incident response for AI system failures. TRIGGERS - Use when user needs help with ai-incident-response related tasks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when working with incident response incident response

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design incident response for AI system failures. TRIGGERS - Use when user needs help with ai-incident-response related tasks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create a one-page service operations guide in HTML. It organizes service details, alerts and first responses, dashboard links, procedures with copyable commands, an on-call schedule, and an incident checklist so teams can find operational instructions together.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating an operations guide for a service
• Documenting first responses to alerts
• Organizing deployment and rollback procedures

Guide production incident handling by establishing impact, start time, and recent changes before proposing action. Document evidence for rollback requests, keep the issue updated, and distinguish service recovery from resolution that explains the incident.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establish the impact and start time of a production incident
• Check whether deployments align with the incident timeline
• Prepare a rollback request with supporting evidence

Develop incident response procedures for LLM outages, declining answer quality, spending spikes, and unsafe outputs. Use example monitoring alerts, severity levels, recovery playbooks, and postmortem guidance to organize detection, response, and follow-up work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan fallback procedures for model provider outages
• Investigate declining answer quality after a deployment
• Prepare emergency controls for token spending spikes

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a suspicious email reported by an employee
• Assessing exposure after a link click or credential entry
• Removing phishing messages across organizational mailboxes