Results for “actions”
7 skills
mukul975 hunting-for-scheduled-task-persistence
Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.
24.6k · bundle
mukul975 implementing-soar-automation-with-phantom
Automates alert triage, IOC enrichment, containment actions, and incident response playbooks using Splunk SOAR (Phantom) to reduce manual analyst work and standardize response procedures.
24.6k · bundle
mukul975 implementing-soar-playbook-with-palo-alto-xsoar
Automate incident response workflows in Cortex XSOAR by building playbooks that orchestrate security tools, enrich indicators, and execute containment actions.
24.6k · bundle
More results
mukul975 detecting-port-scanning-with-fail2ban
Configures Fail2ban with custom filters and actions to detect port scanning, SSH brute force, and network reconnaissance, automatically banning offending IPs and alerting security teams.
24.6k · bundle
mukul975 containing-active-breach
Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.
24.6k · bundle
mukul975 investigating-phishing-email-incident
Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.
24.6k · bundle
mukul975 implementing-endpoint-detection-with-wazuh
Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.
24.6k · bundle