“siem”的搜索结果

Analyze authentication logs to spot suspicious sign-ins, password attacks, and possible account compromise. Statistical baselines and machine learning help compare login activity with normal user behavior, while example SIEM queries support security investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious sign-in alerts
• Detecting geographically inconsistent logins
• Finding brute force and password spraying

Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.

中文简介正在准备中。当前显示英语简介。

• Investigating alerts about suspicious LSASS access
• Finding signs of SAM or NTDS.dit extraction
• Creating detection queries for Splunk or Elastic

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

中文简介正在准备中。当前显示英语简介。

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

中文简介正在准备中。当前显示英语简介。

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows. Use when the user mentions 'SIEM,' 'detection engineering,' 'detection rules,' 'Sigma,' 'KQL,' 'SPL,' 'Splunk,' 'Sentinel,' 'Elastic,' 'Wazuh,' 'Chronicle,' 'detection-as-code,' 'MITRE ATT&CK mapping,' 'log coverage,' 'alert tuning,' 'use case development,' or needs help building or improving security detections.

中文简介正在准备中。当前显示原文说明。

Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.

中文简介正在准备中。当前显示原文说明。

Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.

中文简介正在准备中。当前显示原文说明。

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

中文简介正在准备中。当前显示原文说明。

bu skill covers Dağıt:ing Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL Tespit queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

中文简介正在准备中。当前显示原文说明。

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

中文简介正在准备中。当前显示原文说明。

This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.

中文简介正在准备中。当前显示原文说明。

Detect attacks that misuse legitimate Windows tools by examining command arguments, parent and child processes, and network connections. Create Sysmon logging configurations and Sigma detection rules, analyze endpoint logs, and review application controls while accounting for legitimate usage.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for misuse of Windows tools
• Investigating unusual process chains in alerts
• Hunting for fileless attacks in endpoint logs

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

中文简介正在准备中。当前显示英语简介。

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.

中文简介正在准备中。当前显示英语简介。

• Hunting for unusual service ticket requests
• Investigating suspected service account password attacks
• Validating alerts and organizing response evidence

Build or tune a monitoring pipeline that learns normal user behavior from activity logs. Use Elasticsearch or OpenSearch to score unusual activity, compare colleagues in similar roles, and combine warning signs into insider threat alerts.

中文简介正在准备中。当前显示英语简介。

• Building continuous monitoring for insider threats
• Scoring unusual logins and large downloads
• Comparing behavior across similar job roles

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

中文简介正在准备中。当前显示英语简介。

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.

中文简介正在准备中。当前显示英语简介。

• Adding ransomware warning files to shared folders
• Supplementing endpoint protection with decoy file monitoring
• Testing alerts triggered by decoy file changes

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Build Splunk pipelines that import threat intelligence and match security events against indicators such as malicious IP addresses, domains, and file hashes. Add source, confidence, and severity details so analysts have context when investigating matches.

中文简介正在准备中。当前显示英语简介。

• Importing external threat feeds into Splunk
• Matching network and endpoint logs against threat indicators
• Adding threat and asset context to alerts

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

中文简介正在准备中。当前显示英语简介。

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

中文简介正在准备中。当前显示英语简介。

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises