“blue-team”的搜索结果

System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement

中文简介正在准备中。当前显示原文说明。

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

中文简介正在准备中。当前显示英语简介。

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts

Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.

中文简介正在准备中。当前显示英语简介。

• Investigate repeated login failures on exposed RDP services
• Identify accounts targeted by password guessing
• Check for successful logins after repeated failures

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

中文简介正在准备中。当前显示英语简介。

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.

中文简介正在准备中。当前显示英语简介。

• Building a Sliver server for an authorized red-team exercise
• Configuring multiple communication protocols for an exercise
• Managing certificate-based access for multiple operators

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

中文简介正在准备中。当前显示原文说明。

Security Operations Center skill for alert triage, detection engineering, incident response, log analysis, threat hunting, SIEM queries, EDR investigation, timeline building, IOC handling, escalation notes, containment recommendations, and analyst-ready reporting. Use for blue-team operations, suspicious event analysis, and defensive cybersecurity workflows.

中文简介正在准备中。当前显示原文说明。

Strengthen defensive security operations — detection engineering, hardening, monitoring, and continuous defense improvement.

中文简介正在准备中。当前显示原文说明。

White-box security audit. Blue-teamer and lead red-teamer run in parallel isolation for an independent first pass — neither sees the other's output during reconnaissance. A synthesis step categorizes findings into four prescriptive buckets (anchoring-suppressed, convergent, blue-flagged-unverified, divergent), producing a unified target list. Focused red-teamers then deep-dive each target. Iterates when exploit chains are discovered. Heavy and thorough by design. Advisory only — produces findings and proposes tickets; does not implement remediation.

中文简介正在准备中。当前显示原文说明。

Use for an adversarial red-team / blue-team / auditor review of an AI agent's CONFIG + behaviour (rules, skills, MCP, hooks, permissions) — attack-chain → defensive-gap list, not a code audit.

中文简介正在准备中。当前显示原文说明。

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.

中文简介正在准备中。当前显示原文说明。

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.

中文简介正在准备中。当前显示原文说明。

Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.

中文简介正在准备中。当前显示原文说明。

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.

中文简介正在准备中。当前显示原文说明。