Mahipal

Design a security operations center escalation matrix that defines incident priorities, response deadlines, analyst responsibilities, and notification paths. Use business impact, asset importance, and data sensitivity to decide when incidents need senior or management attention.

中文简介正在准备中。当前显示英语简介。

• Defining incident priorities and response deadlines
• Clarifying handoffs between analyst tiers
• Setting escalation rules for overdue incidents

Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.

中文简介正在准备中。当前显示英语简介。

• Establishing an incident response program
• Documenting phishing or ransomware response procedures
• Designing automated security response workflows

Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.

中文简介正在准备中。当前显示英语简介。

• Extending on-premises authentication to cloud resources
• Comparing authentication models for hybrid identity
• Setting up SAML single sign-on for SaaS applications

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

中文简介正在准备中。当前显示英语简介。

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Build a repeatable process for Microsoft monthly security updates, from reviewing advisories and ranking vulnerabilities to testing, staged deployment, and verification. Helps teams set response deadlines based on risk and report remaining unpatched systems.

中文简介正在准备中。当前显示英语简介。

• Establishing a monthly Microsoft security update workflow
• Prioritizing vulnerabilities by exploitation risk
• Planning pilot and production deployment stages

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

中文简介正在准备中。当前显示英语简介。

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

中文简介正在准备中。当前显示英语简介。

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

中文简介正在准备中。当前显示英语简介。

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

中文简介正在准备中。当前显示英语简介。

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Review personal data handling against GDPR requirements, covering processing records, legal grounds, individual rights, breach procedures, and international transfers. Produce findings by article and a prioritized improvement roadmap with responsibilities, estimated costs, and timelines.

中文简介正在准备中。当前显示英语简介。

• Preparing evidence for a regulatory audit
• Reviewing privacy requirements for a new system
• Assessing GDPR gaps during acquisition due diligence

Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.

中文简介正在准备中。当前显示英语简介。

• Define vulnerability remediation deadlines
• Visualize overdue vulnerabilities
• Automate reminders and management escalations

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

中文简介正在准备中。当前显示英语简介。

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

中文简介正在准备中。当前显示英语简介。

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.

中文简介正在准备中。当前显示英语简介。

• Building a Sliver server for an authorized red-team exercise
• Configuring multiple communication protocols for an exercise
• Managing certificate-based access for multiple operators

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Reconstruct activity on a compromised computer by combining file timestamps, event logs, browser history, and other evidence into one timeline. Extract and filter events with Plaso, then review and annotate them collaboratively in Timesketch.

中文简介正在准备中。当前显示英语简介。

• Reconstructing the sequence of a computer compromise
• Comparing events across logs and file records
• Investigating timestamp changes and cleared logs

Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.

中文简介正在准备中。当前显示英语简介。

• Establish recurring infrastructure vulnerability scans
• Prioritize fixes using asset importance and exploitation data
• Track remediation deadlines and overdue findings

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

中文简介正在准备中。当前显示英语简介。

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.

中文简介正在准备中。当前显示英语简介。

• Standardizing exception requests for delayed vulnerability fixes
• Recording alternative protections and risk acceptance
• Checking expired exceptions and producing monthly reports

Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.

中文简介正在准备中。当前显示英语简介。

• Combining findings from multiple security scanners
• Importing scan results automatically from CI/CD pipelines
• Connecting vulnerability findings to Jira tickets

Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.

中文简介正在准备中。当前显示英语简介。

• Preparing documented risk analysis for compliance frameworks
• Assessing a new system before launch
• Reporting the highest risks to leadership

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

中文简介正在准备中。当前显示英语简介。

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Guide response to suspected or confirmed malware infections across enterprise endpoints. Identify the malware and entry route, assess affected systems, coordinate containment and removal, and document recovery checks, infection timelines, and observable signs of compromise.

中文简介正在准备中。当前显示英语简介。

• Investigating malware alerts from endpoint security tools
• Assessing infection spread across multiple endpoints
• Planning containment, removal, and endpoint recovery

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

中文简介正在准备中。当前显示英语简介。

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns