Results for “detection-rules”
12 skills
google detection-engineering-coverage-evaluation
Automates detection engineering workflows in Google SecOps by extracting threat intelligence, generating detection opportunities, simulating attacker behavior with synthetic events, evaluating rule coverage, and creating new YARA-L 2.0 rules to close gaps.
14.4k
cloudthinker-ai aws-guardduty
Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.
7
cloudthinker-ai gcp
Executes GCP CLI commands with credential injection and enforces anti-hallucination rules for billing data analysis, including net cost calculation, currency detection, and anomaly detection.
7 · bundle
trailofbits semgrep
Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.
6k · bundle
More results
mukul975 detecting-network-scanning-with-ids-signatures
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.
24.6k · bundle
mukul975 performing-purple-team-atomic-testing
Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.
24.6k · bundle
mukul975 detecting-data-and-model-poisoning
Detect poisoned training data and backdoored models across the ML pipeline using statistical analysis, activation clustering, and spectral signatures.
24.6k · bundle
mukul975 performing-cloud-native-forensics-with-falco
Deploys and manages Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Parses Falco alerts for incident response.
24.6k · bundle
yanacuti1121 deepeval
DeepEval — LLM evaluation framework, RAG metrics, hallucination detection, red-teaming, CI/CD integration
2
mukul975 configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms.
24.6k · bundle
mukul975 analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.
24.6k · bundle
mukul975 implementing-security-monitoring-with-datadog
Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.
24.6k · bundle