Security

jihedbfr-art Bundle

Use when handing over between SOC shifts — the structured handoff that ensures ongoing investigations, watch items, and context transfer cleanly so nothing falls through the cracks.

jihedbfr-art Bundle

Use when migrating from one SIEM to another — moving detections, data sources, and operations to a new platform without going blind during the transition.

jihedbfr-art Bundle

Use when checking whether an organisation has leaked API keys, credentials, or internal infrastructure details in public git repositories.

jihedbfr-art Bundle

Use when an app uses SAML SSO — testing for signature-wrapping, unsigned-assertion, and comment-injection attacks that forge authentication, plus correct validation.

jihedbfr-art Bundle

Use when automating SOC work with SOAR — playbooks that handle the repetitive parts of triage and response so analysts focus on judgement, without automating away control of consequential actions.

jihedbfr-art Bundle

Use when testing whether an API limits how often and how heavily it can be called — the missing controls that enable brute force, scraping, and cost/DoS attacks.

jihedbfr-art Bundle

Use when analysing a running mobile app by hooking its functions with Frida — observing and modifying behaviour at runtime to test logic, bypass checks, and inspect data.

jihedbfr-art Bundle

Use when reviewing how code fails and what it records — catching info leaks in errors, swallowed failures that mask security events, and log injection.

jihedbfr-art Bundle

Use when measuring SOC performance honestly — the metrics that show whether the SOC is effective and where it's struggling, avoiding the vanity numbers that look good and mean nothing.

jihedbfr-art Bundle

Use when testing whether an API lets one user access another user's objects by changing an ID — the BOLA/IDOR flaw that tops the OWASP API list, plus the server-side fix.

jihedbfr-art Bundle

Use when you need a complete inventory of what's inside a build — every dependency and its version — as an SBOM you can scan, track, and hand to auditors.

jihedbfr-art Bundle

Use as a repeatable, time-boxed checklist for the security pass on an everyday pull request — where to look first, what to wave through, when to block.

jihedbfr-art Bundle

Use when gathering indicators of compromise from feeds and reports — collecting them without drowning in junk, and vetting them so you don't act on false or stale data.

jihedbfr-art Bundle

Use when turning threat intelligence into detections and hunts — closing the loop so intel drives defence instead of sitting in a platform as unused reports.

jihedbfr-art Bundle

Use at the start of a suspected security incident to decide quickly whether it's real, how bad it is, and what response it warrants — before jumping to containment.

jihedbfr-art Bundle

Use when testing how an app handles login, credentials, lockout, and password reset — the weaknesses that let an attacker log in as someone else — and the fixes.

jihedbfr-art Bundle

Use when assessing or implementing a mobile app's anti-reversing defences — root/jailbreak detection, obfuscation, and anti-tampering — understanding what they achieve and their limits.

jihedbfr-art Bundle

Use when scanning project dependencies for known vulnerabilities in CI — catching vulnerable third-party packages before they ship, and telling exploitable from merely-flagged.

jihedbfr-art Bundle

Use when deciding which detections to build — driving the priorities from real threat intelligence about what attackers targeting you actually do, not from guesses or convenience.

jihedbfr-art Bundle

Use when writing and delivering threat-intel reports — producing intelligence people actually read and act on, and getting it to the right consumers in the right form and time.

jihedbfr-art Bundle

Use when mapping EU cybersecurity regulatory duties to controls — NIS2, GDPR security obligations, and DORA — so the organisation meets its legal requirements, not just best practice.

jihedbfr-art Bundle

Use when collecting compliance evidence and preparing for audits — gathering proof that controls operate continuously, so audits are routine instead of a last-minute scramble.

jihedbfr-art Bundle

Use when testing whether NTLM authentication can be relayed to authenticate to other services — a classic AD attack — and the signing/channel-binding that shuts it down.

jihedbfr-art Bundle

Use when applying and verifying a Linux hardening baseline at scale — automating CIS Benchmark checks and remediation so hosts start hardened and don't drift.

jihedbfr-art Bundle

Use when establishing verifiable build provenance — proving how and where an artifact was built using the SLSA framework, so consumers can trust the build wasn't subverted.

jihedbfr-art Bundle

Use when ensuring reproducible, verified dependencies — using lockfiles with integrity hashes so you install exactly the packages you vetted, and nothing gets swapped.

jihedbfr-art Bundle

Use when reviewing Linux file and directory permissions — the world-writable files, exposed sensitive files, and misused ACLs that lead to tampering or privilege escalation.

jihedbfr-art Bundle

Use when defending against typosquatted and malicious lookalike packages — catching the malicious package with a name close to a popular one before a typo pulls it into your build.

jihedbfr-art Bundle

Use when assessing Group Policy as both an attack surface and a defensive tool — finding GPOs that can be abused to push code across the domain, and using them to enforce hardening.

jihedbfr-art Bundle

Use when you have a low-privilege shell on a Linux host and need to enumerate the ways up to root — SUID, sudo, cron, capabilities — and how to close each.

jihedbfr-art Bundle

Use when working a SOC alert queue — a repeatable path from raw alert to verdict (false positive, benign, or escalate) that stays consistent across analysts and shifts.

jihedbfr-art Bundle

Use when protecting against dependency confusion attacks — where an attacker publishes a public package matching your internal package name and your build pulls theirs instead.

jihedbfr-art Bundle

Use when you have any domain user and want to crack service-account passwords via their Kerberos service tickets — and how to make the attack yield nothing.

jihedbfr-art Bundle

Use when hardening the Linux kernel via sysctl and boot settings — the network and memory-protection tunables that reduce exploitability and blunt common attacks.

jihedbfr-art Bundle

Use when setting up SOC on-call and escalation — the runbooks, tiers, and handoffs that make sure serious alerts reach the right person fast and nothing falls through at 3am.

jihedbfr-art Bundle

Use when balancing log retention against SIEM cost — keeping the data you need for detection, hunting, and compliance without paying premium ingest for everything.