781 件 ・ 関連度順
概要と使いどころ
This skill should be used when the user asks to "analyze logs for threats", "detect suspicious activity", "scan for brute force attempts", "identify injection attacks", or "audit access patterns for anomalies".
日本語の概要は準備中です。原文の説明を表示しています。
STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.
日本語の概要は準備中です。原文の説明を表示しています。
Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon hashes, tracker IDs, TLS certs, phishing-kit fingerprinting, campaign clustering), username/email/phone enumeration, breach and infostealer-log triage, image forensics, geolocation, crypto-wallet and IBAN/bank-account tracing, darknet search, M365/Azure and SaaS tenant recon, China/Sinophone recon (ICP filings, PRC corporate registries, Baidu/FOFA/Quake/ZoomEye), vulnerability and ransomware lookup, threat modeling, PII redaction, and structured reporting. Commands include /case, /sweep, /query, /webpivot, /username, /phone, /email-deep, /breach-deep, /icp, /cn-corp, /iban, /stealer-log, /exposure, /threat-model, /report, /brief, /redact, /apikeys.
日本語の概要は準備中です。原文の説明を表示しています。
Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.
日本語の概要は準備中です。原文の説明を表示しています。
Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting
日本語の概要は準備中です。原文の説明を表示しています。
Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.
日本語の概要は準備中です。原文の説明を表示しています。
Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.
日本語の概要は準備中です。原文の説明を表示しています。
Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.
日本語の概要は準備中です。原文の説明を表示しています。
Design a threat hunting program — maturity assessment, hunting calendar, and playbook library. Use when asked to "build a threat hunting program", "assess our hunting maturity", or "create a hunt playbook library".
日本語の概要は準備中です。原文の説明を表示しています。
Perform STRIDE threat modeling for each component and trust boundary and produce a threat register. Use when reviewing a feature for security.
日本語の概要は準備中です。原文の説明を表示しています。
Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a
日本語の概要は準備中です。原文の説明を表示しています。
Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. Activates for requests to hunt fileless malware, detect in-memory execution, or find registry-resident and reflective-loading activity.
日本語の概要は準備中です。原文の説明を表示しています。
Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportunities (TDOs), simulating attacker behavior with synthetic UDM events, evaluating rule coverage, generating new YARA-L 2.0 rules to close coverage gaps, and with user approval, deploy them to SecOps. Don't use when asked to perform threat hunting actions, and SOC investigative actions.
日本語の概要は準備中です。原文の説明を表示しています。
Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to "find CVE discussions", "security threat monitoring", "OSINT social media", "vulnerability intelligence", "breach mentions", or "threat intel from Twitter/Reddit".
日本語の概要は準備中です。原文の説明を表示しています。
Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).
日本語の概要は準備中です。原文の説明を表示しています。
Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review".
日本語の概要は準備中です。原文の説明を表示しています。
Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.
日本語の概要は準備中です。原文の説明を表示しています。
This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.
日本語の概要は準備中です。原文の説明を表示しています。
Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.
日本語の概要は準備中です。原文の説明を表示しています。
Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.
日本語の概要は準備中です。原文の説明を表示しています。
Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.
日本語の概要は準備中です。原文の説明を表示しています。
Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering and threat-informed defense.
日本語の概要は準備中です。原文の説明を表示しています。
Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.
日本語の概要は準備中です。原文の説明を表示しています。
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
日本語の概要は準備中です。原文の説明を表示しています。