Results for “syscall-monitoring”

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Track Slack communities, Discord servers, Facebook groups, and forums for buying signals and engagement opportunities

Operate the VSS alert pipeline for real-time monitoring, Alert-Bridge subscriptions, Slack notifications, incident queries, and camera onboarding.

Monitors OpenClaw model API usage and prompts for user confirmation before switching models when quota is low.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Design SLA monitoring with alerts, dashboards, and reporting. TRIGGERS - Use when user needs help with sla-monitor related tasks.

Design SLA monitoring with alerts, dashboards, and reporting. TRIGGERS - Use when user needs help with sla-monitor related tasks.

Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration.

Use to turn a one-off support search into a standing monitor or alert that stays useful instead of being muted within a fortnight. Trigger for "alert me when a customer mentions X", "notify the team when complaints spike", "keep watching for this", "set up a daily monitor for", turning an ad-hoc sweep into something recurring, or an existing alert nobody reads any more.

Manages phone calls and meetings by preparing with context, capturing notes in real time, tracking commitments and follow-ups, and drafting follow-up messages, with all data stored locally.

Monitor service level agreements and generate compliance reports with breach alerts

Configure privileged session monitoring and recording using CyberArk PSM or open-source alternatives like Teleport, with keystroke logging, real-time alerts, and compliance audit trails.

Monitor SLURM/PBS jobs and their logs. Use when the user asks to monitor, check, or watch a submitted job. Automatically detects running/pending jobs, tails logs, and reports errors.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.

Configure, deploy, and manage Senpi Trading Runtime (OpenClaw plugin @senpi-ai/runtime) for automated on-chain position tracking with DSL trailing stop-loss protection. Use when a user needs to create or modify runtime YAML files, configure DSL (Dynamic Stop-Loss) exit engine parameters (phases, tiers, time-based cuts), set up the position_tracker scanner to monitor a wallet's positions on Hyperliquid, install/list/delete runtimes via CLI, or inspect DSL-tracked positions. The runtime does NOT create strategy wallets; create/get the strategy wallet via Senpi MCP first, then link that existing wallet in runtime YAML. Triggers on mentions of senpi, Senpi runtime, DSL exit, stop-loss tiers, position tracker, trailing stop, openclaw senpi, dsl_preset, or strategy YAML configuration."

Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns using deep packet inspection with pymodbus, Scapy, and Zeek.

Monitor cloud infrastructure and applications using metrics, logs, and traces to provide real-time observability into performance, health, and reliability. Use when the user requests cloud monitoring or provides relevant inputs for this workflow.

Designs effective alerting and incident management for production services, covering alert rules, on-call rotations, runbooks, and incident response workflows.

Post-deploy canary monitoring. (gstack)

A funnel and account-scoring diagnostic engine for any sales org. Connect a CRM and a product-analytics tool (plus optional enrichment, community, and meeting tools). Three modes. (1) FUNNEL DIAGNOSIS finds leaky conversion gates by channel with per-stage leakage, dollarized leverage points, and cohort velocity. (2) SPRINT PLANNING enriches qualified accounts into a ranked backlog with verified buying committees. (3) SCORING AUDIT finds where your scoring model is missing real ICPs. Trigger on 'funnel diagnosis', 'diagnose the funnel', 'where are we leaking', 'why is [channel] underperforming', 'conversion by channel', 'sprint planning', 'score these accounts', 'find missed ICPs', 'audit the scoring model', or any channel-level cohort-conversion, account-prioritization, or scoring-gap question.

Proactive self-monitoring of infrastructure, services, and health. Tracks disk/memory/load, service health, cron job status, recent errors. Auto-fixes safe issues. Triggers on: health check, heartbeat, monitor status, service status, infrastructure check.

Queries video analytics incidents, alerts, metrics, and sensor data from Elasticsearch via the VA-MCP server.

Monitor CPU load, per-core usage, and rank top resource-consuming processes. Use when checking temperatures, ranking processes, tracking load.

Monitor brand mentions, analyze sentiment, and identify trends across social platforms. Use when the user needs to analyze social data, track brand health, or understand audience sentiment.

Queries Azure Monitor metrics, manages Log Analytics workspaces, audits alert rules and diagnostic settings, and configures action groups via Azure CLI.

Supply-chain malware infection scanner. IoC-based local scan + safe eradication for npm/PyPI worm campaigns (Mini Shai-Hulud 1st/2nd, S1ngularity, lottie-player). Detects OS persistence (LaunchAgent/systemd), IDE-hook implants (.claude/.vscode/.github/workflows), lockfile-pinned malicious versions, and known C2/Session-Protocol exfil traces. Orchestrates credential rotation in the correct order so revocation does not trigger the `rm -rf ~/` retaliation payload. Don't use for static SAST (Sentinel), skill/MCP/`.claude/` supply-chain audit (Chain), Sigma/YARA rule authoring (Vigil), or incident coordination (Triage).

Analyze Siemens S7comm and S7CommPlus protocol traffic to identify vulnerabilities such as replay attacks, integrity bypass, unauthorized CPU stop commands, and program download manipulation in SIMATIC S7 PLCs.

用于审计Claude技能和命令的质量。支持快速扫描（仅变更技能）和全面盘点模式，采用顺序子代理批量评估。

Monitors Xianyu (goofish.com) for newly listed items matching keywords, price ranges, and filters, with automated scanning and Discord notifications.

Sets one-shot reminders for events, tasks, and deadlines, confirming the time and scheduling delivery when cron is available.

Investigate security incidents by correlating Windows event logs, firewall, proxy, and authentication data using Splunk SPL queries and Enterprise Security.

Deploys and configures Zeek network security monitor to passively analyze traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.

Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.

Monitor for API billing errors and alert the owner and admin immediately. Use when: an API billing error is detected, a peer PA reports a billing error, or during routine health checks. Handles detection, notification, and fallback model switching. Model-agnostic: works with any LLM provider (Anthropic, OpenAI, Google, etc.).

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.