「event」の検索結果

3,112 件・関連度順

概要と使いどころ

detecting-insider-data-exfiltration-via-dlp

無料

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

detecting-malicious-scheduled-tasks-with-sysmon

無料

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

detecting-aws-guardduty-findings-automation

無料

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

correlating-security-events-in-qradar

無料

Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

containing-active-breach

無料

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

analyzing-powershell-empire-artifacts

無料

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

analyzing-powershell-script-block-logging

無料

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

analyzing-security-logs-with-splunk

無料

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

analyzing-threat-landscape-with-misp

無料

Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.

日本語の概要は準備中です。原文の説明を表示しています。

andycungkrinx91/konoha92026年10月9日更新

metainformant-src-metainformant-life-events-workflow

無料

METAINFORMANT rules for directory src/metainformant/life_events/workflow. Use when editing, adding tests, or reviewing code under this path. Read the linked AGENTS.md first; use uv only, write outputs to output/, real implementations.

日本語の概要は準備中です。原文の説明を表示しています。