“detection-engineering”的搜索结果

Evaluate whether Google SecOps rules detect threats described in articles or supplied text. Generate simulated attack logs, identify coverage gaps, summarize matching rules, and create rules for uncovered threats, with user approval before adding them.

中文简介正在准备中。当前显示英语简介。

• Evaluate detection coverage for threats described in a blog
• Test existing rules with simulated attack logs
• Review matching rules and their alerting status

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

中文简介正在准备中。当前显示英语简介。

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

中文简介正在准备中。当前显示英语简介。

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Investigate Entra ID reconnaissance by searching Graph API logs for tool signatures and unusual directory queries. Use KQL, a log query language, to correlate suspicious requests with sign-ins and turn useful searches into Sentinel detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating Graph API activity after suspected credential theft
• Checking whether offensive tool activity is visible in logs
• Creating and tuning scheduled Sentinel detection rules

Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.

中文简介正在准备中。当前显示英语简介。

• Giving existing honeypots a coordinated strategy
• Selecting decoys for a specific threat actor
• Writing an adversary engagement operation plan

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

中文简介正在准备中。当前显示英语简介。

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

中文简介正在准备中。当前显示英语简介。

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Search Google SecOps events for threats that have not triggered alerts. Test attack hypotheses, check historical records for compromise indicators, and examine unusual activity, then document findings and add them to relevant security cases.

中文简介正在准备中。当前显示英语简介。

• Test a threat hypothesis based on an attack technique
• Check historical events for newly disclosed compromise indicators
• Investigate rare program executions and network destinations

Build and test threat detection rules in Google SecOps using YARA-L 2.0, its rule language. The skill also checks existing coverage with simulated attack events, proposes rules for confirmed gaps, and deploys approved rules.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules from known attack behavior
• Tuning existing rules to reduce false positives
• Checking detection gaps against threat reports and CVE disclosures

Triage Google SecOps alerts by checking logs, related cases, asset importance, and threat intelligence. Classify findings, adjust severity and priority, and document evidence for closing benign cases or handing suspicious activity to incident responders.

中文简介正在准备中。当前显示英语简介。

• Distinguish false alarms from malicious activity
• Review alert priority using asset risk
• Close duplicate cases with references

Investigate security incidents in Google SecOps by connecting host, user, and network events. Reconstruct attack timelines, trace movement between systems, assess affected assets, and organize findings into case notes and investigation reports.

中文简介正在准备中。当前显示英语简介。

• Reconstruct a suspicious host's activity timeline
• Investigate unusual user logins and resource access
• Trace attacker movement between systems

Designs and reviews detections from telemetry prerequisites, correlation logic, Sigma metadata, severity, status, and benign cases. Use for detection rules, Sigma review, analytic coverage, or tuning; not generic logging advice or live deployment.

中文简介正在准备中。当前显示原文说明。

Collaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconfliction, and MTTD/coverage reporting

中文简介正在准备中。当前显示原文说明。

Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL, Chronicle, and Elastic detection rules. Covers ATT&CK coverage mapping, telemetry gap analysis, false-positive tuning, detection-as-code pipelines, and validation with Atomic Red Team and Caldera. Use to design durable detections backed by tests.

中文简介正在准备中。当前显示原文说明。

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.

中文简介正在准备中。当前显示原文说明。

Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.

中文简介正在准备中。当前显示原文说明。

Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.

中文简介正在准备中。当前显示原文说明。

Tunes noisy detections by analyzing historical alert data to quantify false-positive sources, recommend allow-list filters and threshold adjustments, and measure precision impact. Activates for requests to tune a detection, reduce false positives, or analyze alert noise and recommend filters.

中文简介正在准备中。当前显示原文说明。

Validates detection coverage by mapping Atomic Red Team tests to ATT&CK techniques, checking which of your detections cover each tested technique, and reporting coverage gaps. Activates for requests to validate detections with atomic tests, map Atomic Red Team to coverage, or find detection gaps against tested techniques.

中文简介正在准备中。当前显示原文说明。

Converts a successful threat hunt into a durable detection by extracting the discriminating logic, defining data sources and thresholds, and emitting a Sigma rule plus a test and tuning plan. Activates for requests to operationalize a hunt, turn a finding into a detection rule, or productionize hunt logic as a Sigma detection.

中文简介正在准备中。当前显示原文说明。

Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).

中文简介正在准备中。当前显示原文说明。

Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events, hunting for MITRE ATT&CK techniques, or detecting behavioral and statistical outliers using UDM queries. Don't use for incoming alert triage (use secops-triage), active incident response and timeline deep-dives on a known breach (use secops-investigate), or detection rule authoring (use secops-detection-engineering).

中文简介正在准备中。当前显示原文说明。