Results for “threat-hunting”
4 skills
mukul975 Analyzing Azure Activity Logs For Threats
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications.
24.6k · bundle
mukul975 Building Cloud Siem With Sentinel
Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations across AWS, Azure, and GCP.
24.6k · bundle
More results
mukul975 Detecting AWS Cloudtrail Anomalies
Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.
24.6k · bundle
mukul975 Analyzing Cloud Storage Access Patterns
Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls, and potential data exfiltration using statistical baselines.
24.6k · bundle