查找技能

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

中文简介正在准备中。当前显示英语简介。

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Investigate compromised credentials across AWS, Azure, and GCP by correlating security alerts and audit logs. Examines unusual API activity and suspicious sign-ins, helps assess the affected scope, and guides containment actions such as disabling keys and revoking sessions.

中文简介正在准备中。当前显示英语简介。

• Investigate cloud API activity from unfamiliar locations
• Assess exposure after a credential leak notification
• Correlate suspicious sign-ins across cloud providers

Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Audit AWS IAM policies for excessive permissions
• Find permission combinations that enable privilege escalation
• Trace risky policies to affected users and roles

Scan code, configuration files, and Git history for exposed AWS credentials with TruffleHog. Checks whether detected keys remain active and guides key replacement, incident investigation, and automated checks before commits and during CI/CD.

中文简介正在准备中。当前显示英语简介。

• Auditing Git history for exposed AWS keys
• Adding credential checks before commits and in CI/CD
• Investigating credential exposure after a GuardDuty alert

Set up and operate Amazon GuardDuty to detect threats in AWS. Configure protection features, centralize findings across accounts, investigate suspicious activity, and build automated responses with EventBridge and Lambda, including containment of potentially compromised resources.

中文简介正在准备中。当前显示英语简介。

• Setting up threat detection for AWS accounts
• Investigating credential abuse and compromised instances
• Automating responses to high-severity findings

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

中文简介正在准备中。当前显示英语简介。

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Configure AWS Verified Access for VPN-free access to internal applications. Combine user identity and device security checks, write Cedar access policies, and use Terraform and AWS RAM to deploy and share access controls across AWS accounts.

中文简介正在准备中。当前显示英语简介。

• Replacing VPN access to internal applications
• Writing policies based on users and device security
• Deploying Verified Access with Terraform

Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.

中文简介正在准备中。当前显示英语简介。

• Add intrusion alerts to shared folders
• Detect use of decoy cloud credentials
• Monitor decoy documents for signs of data theft

Deploy Prisma Access to secure access to internal applications for remote users and branches. Configure connectors, GlobalProtect agents, access policies based on user groups and device security, and centralized logging through Strata Cloud Manager.

中文简介正在准备中。当前显示英语简介。

• Migrating VPN and branch security to Prisma Access
• Restricting internal app access by user and device
• Integrating access controls with existing Palo Alto NGFW systems

Set up Cloudflare Access and Tunnel to protect internal applications using user identity and device health checks. Covers application access policies, WARP device enrollment, and audit logging for teams replacing VPN access.

中文简介正在准备中。当前显示英语简介。

• Replace VPN access with application-specific permissions
• Expose internal apps without opening inbound ports
• Limit contractors to approved applications

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

中文简介正在准备中。当前显示英语简介。

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Review personal data handling against GDPR requirements, covering processing records, legal grounds, individual rights, breach procedures, and international transfers. Produce findings by article and a prioritized improvement roadmap with responsibilities, estimated costs, and timelines.

中文简介正在准备中。当前显示英语简介。

• Preparing evidence for a regulatory audit
• Reviewing privacy requirements for a new system
• Assessing GDPR gaps during acquisition due diligence

Set up Microsoft Sentinel to collect security logs from AWS, Azure, and GCP. Build detection queries, investigate historical activity, and create automated response workflows for a centralized security operations team.

中文简介正在准备中。当前显示英语简介。

• Centralizing security monitoring across multiple clouds
• Migrating from an existing SIEM platform
• Automating responses to suspicious cloud activity

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

中文简介正在准备中。当前显示英语简介。

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

中文简介正在准备中。当前显示英语简介。

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.

中文简介正在准备中。当前显示英语简介。

• Reviewing Terraform modules and plans before deployment
• Adding security checks to Terraform CI/CD pipelines
• Enforcing organization-specific infrastructure rules

Use Intel CHIPSEC to inspect firmware protections, including BIOS write locks and Secure Boot settings. Save test results, extract firmware for offline comparison, and review UEFI variables to investigate configuration weaknesses or suspicious changes.

中文简介正在准备中。当前显示英语简介。

• Establishing a firmware security baseline for new hardware
• Checking BIOS and SPI flash write protection
• Extracting firmware for comparison with a known-good image

Audit AWS, Azure, and GCP configurations against CIS Benchmarks, security configuration guidelines. Use automated scan results to identify failed checks, prioritize fixes, report compliance by area, and establish ongoing monitoring for configuration changes.

中文简介正在准备中。当前显示英语简介。

• Running an initial cloud security configuration audit
• Preparing CIS-related evidence for SOC 2 or ISO 27001 audits
• Prioritizing fixes for failed security checks

Set up and run kube-bench to check Kubernetes configuration against CIS security benchmarks. Select the appropriate benchmark and cluster components, then export JSON or JUnit results for automated pipelines and troubleshoot skipped checks or incorrect detection.

中文简介正在准备中。当前显示英语简介。

• Setting up kube-bench for the first time
• Selecting benchmark versions and scan targets
• Exporting JSON or JUnit results for CI

Analyze access logs from AWS S3, GCS, and Azure Blob Storage to spot unusual downloads, unfamiliar IP addresses, and request spikes. Compare activity with normal patterns and prioritize findings for suspected data theft investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data theft from cloud storage
• Finding bulk downloads outside normal working hours
• Checking unfamiliar IP addresses and sudden request spikes

Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating sequential access to resource IDs
• Examining spikes in authentication failures
• Checking for rate limit bypass and injection attempts

Plan backend services and APIs, from service responsibilities and interface definitions to authentication, failure handling, monitoring, and rollout. Produces architecture diagrams, API specifications, and documented tradeoffs based on business and operational requirements.

中文简介正在准备中。当前显示英语简介。

• Designing an order management API
• Defining responsibilities across multiple services
• Planning retries and timeouts for external integrations