Results for “aws-security-hub”

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Reviews AWS infrastructure as code and deployed resources against the Well-Architected Framework, generating findings and GitHub issues for remediation.

Provides a structured approach to designing, implementing, and troubleshooting AWS security configurations with best practices and verification checklists.

Continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.

Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.

Implement JWT authentication, RBAC guards, Helmet hardening, and Argon2 hashing in NestJS. Use when adding auth strategies, role-based access control, CSRF protection, or security headers.

Enumerate AWS resources and identify misconfigurations using ScoutSuite to generate interactive security reports.

Protect API Gateway endpoints with AWS WAF by configuring managed rule groups, rate limiting, bot control, IP reputation filtering, and monitoring.

Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.

Deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads, including enabling protection plans, interpreting findings, and building automated response workflows.

Deploys and configures host-based intrusion detection systems (Wazuh, OSSEC, AIDE) to monitor file integrity, system calls, and configuration changes across endpoints. Includes FIM policies, rootkit detection, custom alert rules, active response, and SIEM integration.

Store, retrieve, and automatically rotate credentials, API keys, and other secrets using AWS Secrets Manager.

Manage AWS API Gateway for creating, publishing, and securing REST, HTTP, and WebSocket APIs using CLI commands, SAM templates, and best practices.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations across AWS, Azure, and GCP.

Use Pacu modules for AWS privilege escalation, persistence, and backdooring during authorized penetration tests.

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

Deploy cloud-native deception across AWS, Azure, and GCP using decoy resources that generate high-fidelity alerts when attackers interact with them.

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls, and potential data exfiltration using statistical baselines.

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

Analyzes AWS WAF web ACLs, rules, IP sets, and logging configurations, and retrieves blocked/allowed request metrics from CloudWatch.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Audit public skill or plugin bundles for ClawHub, Claude, Hermes, and GitHub release risks. Use when: checking Suspicious/upload flags, dangerous local behaviors, metadata mismatches, legacy auth surface, or non-runtime files before publishing.

Analyzes AWS S3 buckets for storage class distribution, lifecycle policies, access patterns, and cost optimization, including security posture checks like encryption and public access.

Continuously monitor cloud infrastructure for misconfigurations, compliance violations, and security risks using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.