Results for “s3-access-logs”

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls, and potential data exfiltration using statistical baselines.

Parse Apache and Nginx access logs to detect SQL injection, LFI, XSS, scanner fingerprints, and brute-force patterns using regex-based detection, GeoIP enrichment, and statistical anomaly analysis.

Generates audit logs and usage reports for Google Workspace accounts via the Admin SDK Reports API.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Analyze Zeek network logs to detect lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos anomalies, and large internal data transfers.

Design production-ready observability strategies combining metrics, logs, and traces, including SLI/SLO design, golden-signals monitoring, and alert optimization.

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Monitor AWS resources and applications using CloudWatch logs, metrics, alarms, and dashboards with CLI and boto3 examples.

Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.