'security-operations' 검색 결과

Analyze endpoint, cloud storage, and email logs for signs of insider data theft. Use pandas to compare upload volumes with normal user behavior and examine data loss prevention alerts, unusual file access, and activity outside working hours.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected insider data theft
• Finding users with unusually large uploads
• Reviewing file access outside working hours

Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding domains that imitate a brand
• Reviewing unexpected certificate issuers
• Investigating untracked domains and IT assets

Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating sequential access to resource IDs
• Examining spikes in authentication failures
• Checking for rate limit bypass and injection attempts

SecOps for application security, vulnerability management, compliance, and secure development. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or meeting compliance requirements.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.