All categories
DevOps & Cloud
Deployment, cloud, containers, CI/CD, monitoring, and infrastructure
- 20,173
- 841
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse devops & cloud skills
Showing 13,345–13,368 of 20,173 skills
- Deploying Edr Agent With CrowdstrikeDeploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.Votes: 0GitHub stars: 61
- Deploying Cloudflare Access For Zero TrustDeploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.Votes: 0GitHub stars: 61
- Deploying Active Directory HoneytokensDeploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.Votes: 0GitHub stars: 61
- Crdtcrdt skillVotes: 0GitHub stars: 61
- Correlating Security Events In QradarCorrelates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.Votes: 0GitHub stars: 61
- Configuring Zscaler Private Access For ZtnaConfiguring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.Votes: 0GitHub stars: 61
- Configuring Suricata For Network MonitoringDeploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.Votes: 0GitHub stars: 61
- Configuring Snort Ids For Intrusion DetectionInstalls, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.Votes: 0GitHub stars: 61
- Configuring Pfsense Firewall RulesConfigures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.Votes: 0GitHub stars: 61
- Configuring Microsegmentation For Zero TrustConfigure microsegmentation policies to enforce least-privilege workload-to-workload access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures.Votes: 0GitHub stars: 61
- Configuring Host Based Intrusion DetectionConfigures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.Votes: 0GitHub stars: 61
- Configuring Aws Verified Access For ZtnaConfigure AWS Verified Access to provide VPN-less zero trust network access to internal applications using identity and device posture verification with Cedar policy language.Votes: 0GitHub stars: 61
- Conducting Spearphishing Simulation CampaignSpearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to crafVotes: 0GitHub stars: 61
- Conducting Post Incident Lessons LearnedFacilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.Votes: 0GitHub stars: 61
- Conducting Malware Incident ResponseResponds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, worm containment, malware triage, or infected endpoint remediation.Votes: 0GitHub stars: 61
- Conducting Internal Reconnaissance With Bloodhound CeConduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.Votes: 0GitHub stars: 61
- Conducting Cloud Incident ResponseResponds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.Votes: 0GitHub stars: 61
- Collecting Indicators Of CompromiseSystematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.Votes: 0GitHub stars: 61
- Building Threat Intelligence PlatformBuilding a Threat Intelligence Platform (TIP) involves deploying and integrating multiple CTI tools into a unified system for collecting, analyzing, enriching, and disseminating threat intelligence. TVotes: 0GitHub stars: 61
- Building Threat Intelligence Enrichment In SplunkBuild automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.Votes: 0GitHub stars: 61
- Building Threat Feed Aggregation With MispDeploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.Votes: 0GitHub stars: 61
- Building Threat Actor Profile From OsintBuild comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.Votes: 0GitHub stars: 61
- Building Red Team C2 Infrastructure With HavocDeploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.Votes: 0GitHub stars: 61
- Building Phishing Reporting Button WorkflowImplement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.Votes: 0GitHub stars: 61