'soar' 검색 결과

Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding threat context to security alerts
• Processing indicators from phishing email submissions
• Standardizing bulk indicator lookups from threat feeds

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Manages security incident cases in Google SecOps, from reviewing queues and related alerts to updating priorities, assignments, and investigation notes. It supports closing cases with documented causes, with available actions depending on the connected MCP tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing open cases with high priority
• Inspecting related alerts and affected entities
• Recording findings and updating case assignments

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Search Google SecOps events for threats that have not triggered alerts. Test attack hypotheses, check historical records for compromise indicators, and examine unusual activity, then document findings and add them to relevant security cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Test a threat hypothesis based on an attack technique
• Check historical events for newly disclosed compromise indicators
• Investigate rare program executions and network destinations

Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative comments and notes; updating case priority or description; or linking and grouping security alerts within cases. Supports both remote Google SecOps MCP tools and local fallback tools. Don't use for SIEM UDM searches or detection rule authoring.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

bu skill covers Dağıt:ing Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL Tespit queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design a security operations center escalation matrix that defines incident priorities, response deadlines, analyst responsibilities, and notification paths. Use business impact, asset importance, and data sensitivity to decide when incidents need senior or management attention.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining incident priorities and response deadlines
• Clarifying handoffs between analyst tiers
• Setting escalation rules for overdue incidents

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Triage Google SecOps alerts by checking logs, related cases, asset importance, and threat intelligence. Classify findings, adjust severity and priority, and document evidence for closing benign cases or handing suspicious activity to incident responders.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Distinguish false alarms from malicious activity
• Review alert priority using asset risk
• Close duplicate cases with references

Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring OT sensors/micro agents, traffic mirroring, Zero Trust OT monitoring, SIEM/SOAR integrations, or OT network design, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure IoT (use azure-iot), Azure IoT Hub (use azure-iot-hub).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst tiering, and shift handoffs. Use when the user mentions 'SOC,' 'security operations,' 'SOC analyst,' 'alert triage workflow,' 'runbook,' 'escalation,' 'on-call,' 'SOC tiering,' 'tier 1 / tier 2,' 'MTTD,' 'MTTR,' 'alert fatigue,' 'alert tuning,' 'shift handoff,' 'SOAR,' or wants to design or improve a security operations team.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.