Results for “splunk-enterprise-security”

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

Reduce SIEM alert fatigue by systematically tuning detection rules in Splunk and Elastic, using statistical baselines, whitelists, and precision/recall metrics.

Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Performs security scanning, compliance checks, deployment planning, and infrastructure setup, with optional dependency auditing and bundle size analysis.

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Routes security, compliance, and threat-intelligence tasks to specialized sub-skills for threat modeling, penetration testing, incident response, and vulnerability scanning.

Audits trending open-source repos for exploitable vulnerabilities using Semgrep, TruffleHog, osv-scanner, and Slither, then routes findings to responsible disclosure channels (PVR for code flaws, public PRs for dependency CVEs).

Configure and run Nessus vulnerability scans, analyze results, and integrate scanning into continuous vulnerability management workflows.

Simulate and detect software supply chain attacks including typosquatting via Levenshtein distance, dependency confusion testing, package hash verification, and vulnerability scanning with pip-audit.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Scans AI agents, MCP servers, and skills for security vulnerabilities from the command line, detecting prompt injections, tool poisoning, toxic flows, malware payloads, and credential handling issues across 15+ risk categories.

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.