Results for “authentication-events”

11 skills

implementing-siem-correlation-rules-for-apt

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

24.6k · bundle

More results

azure-eventhub-py

Ingest and process high-throughput event streams using Azure Event Hubs SDK for Python, with support for producers, consumers, and checkpointing.

azure-eventhub-ts

Build event streaming applications using Azure Event Hubs SDK for JavaScript (@azure/event-hubs). Use when implementing high-throughput event ingestion, real-time analytics, IoT telemetry, or event-driven architectures with partitioned consumers.

detecting-anomalous-authentication-patterns

Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs.

24.6k · bundle

data-manager-api-event-ingestion

Upload offline conversions, enhanced conversions for leads, click conversions, and Google Analytics events using the Data Manager API /v1/events/ingest endpoint.

audit-analytics

Read-only audit of product-analytics instrumentation: event taxonomy, funnel completeness, consent-gated firing, dead/duplicate/phantom events. Use when "audit our analytics", "are we tracking the right events", "funnel instrumentation", or before iterate-post-launch. PostHog/Amplitude/Mixpanel/GA4.

cloudthinker-ai

Manage and monitor Heap product analytics by querying the Heap API for account info, defined events, user properties, segments, event volume, active users, and data health.

detecting-golden-ticket-attacks-in-kerberos-logs

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

24.6k · bundle

hunting-credential-stuffing-attacks

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

24.6k · bundle

Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and credential transport over HTTP. Detectable with Burp Suite, OWASP ZAP, WebGoat.

Analyze user behavior via the Heap API, including tracking events, adding user properties, and querying events.