All categories
DevOps & Cloud
Deployment, cloud, containers, CI/CD, monitoring, and infrastructure
- 20,173
- 841
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse devops & cloud skills
Showing 13,321–13,344 of 20,173 skills
- Detecting Network Scanning With Ids SignaturesDetect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.Votes: 0GitHub stars: 61
- Detecting Network Anomalies With ZeekDeploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.Votes: 0GitHub stars: 61
- Detecting Modbus Protocol AnomaliesThis skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range validation, timing analysis, unauthorized client detection, and deep packet inspection for malformed Modbus frames. The skill leverages Zeek with Modbus protocol analyzers, Suricata IDS with OT rules, and custom Python-based detection using Markov chain models for normal Modbus transaction sequences.Votes: 0GitHub stars: 61
- Detecting Malicious Scheduled Tasks With SysmonDetect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job ...Votes: 0GitHub stars: 61
- Detecting Living Off The Land With LolbasDetect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysisVotes: 0GitHub stars: 61
- Detecting Living Off The Land AttacksDetect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.Votes: 0GitHub stars: 61
- Detecting Lateral Movement With ZeekDetect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.Votes: 0GitHub stars: 61
- Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.Votes: 0GitHub stars: 61
- Detecting Dnp3 Protocol AnomaliesDetect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.Votes: 0GitHub stars: 61
- Detecting Cryptomining In CloudThis skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.Votes: 0GitHub stars: 61
- Detecting Container Escape With Falco RulesDetect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.Votes: 0GitHub stars: 61
- Detecting Container Escape AttemptsContainer escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicatorsVotes: 0GitHub stars: 61
- Detecting Container Drift At RuntimeDetect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.Votes: 0GitHub stars: 61
- Detecting Command And Control Over DnsDetects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C...Votes: 0GitHub stars: 61
- Detecting Cloud Threats With GuarddutyThis skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection across AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity levels, and building automated response workflows using EventBridge and Lambda.Votes: 0GitHub stars: 61
- Detecting Azure Storage Account MisconfigurationsAudit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.Votes: 0GitHub stars: 61
- Detecting Aws Guardduty Findings AutomationAutomate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time incident response, automatic quarantine of compromised resources, and security notification workflows.Votes: 0GitHub stars: 61
- Detecting Aws Credential Exposure With TrufflehogDetecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.Votes: 0GitHub stars: 61
- Detecting Aws Cloudtrail AnomaliesDetect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.Votes: 0GitHub stars: 61
- Detecting Arp Poisoning In Network TrafficDetect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle interception.Votes: 0GitHub stars: 61
- Deploying Tailscale For Zero Trust VpnDeploy and configure Tailscale as a WireGuard-based zero trust mesh VPN with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer connectivity.Votes: 0GitHub stars: 61
- Deploying Software Defined PerimeterDeploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.Votes: 0GitHub stars: 61
- Deploying Palo Alto Prisma Access Zero TrustDeploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.Votes: 0GitHub stars: 61
- Deploying Osquery For Endpoint MonitoringDeploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.Votes: 0GitHub stars: 61