All categories
DevOps & Cloud
Deployment, cloud, containers, CI/CD, monitoring, and infrastructure
- 19,628
- 818
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse devops & cloud skills
Showing 14,137–14,160 of 19,628 skills
- Detecting Living Off The Land Attacks'Detect abuse of legitimate Windows binaries (LOLBins) used for livingVotes: 0GitHub stars: 67
- Detecting Lateral Movement With Zeek'Detect lateral movement in network traffic using Zeek (formerly Bro)Votes: 0GitHub stars: 67
- Detecting Insider Threat With UebaImplement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearchVotes: 0GitHub stars: 67
- Detecting Dnp3 Protocol AnomaliesDetect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.Votes: 0GitHub stars: 67
- Detecting Cryptomining In Cloud'This skill teaches security teams how to detect and respond to unauthorizedVotes: 0GitHub stars: 67
- Detecting Container Escape With Falco RulesWrites and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tunin...Votes: 0GitHub stars: 67
- Detecting Container Escape AttemptsDetects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_A...Votes: 0GitHub stars: 67
- Detecting Container Drift At RuntimeDetects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary execute...Votes: 0GitHub stars: 67
- Detecting Command And Control Over Dns'Detect command-and-control (C2) traffic tunneled over DNS from tools likeVotes: 0GitHub stars: 67
- Detecting Cloud Threats With Guardduty'Deploy and operationalize Amazon GuardDuty, covering protection plansVotes: 0GitHub stars: 67
- Detecting Azure Storage Account MisconfigurationsAudit Azure Blob and ADLS storage accounts for public access exposure, weakVotes: 0GitHub stars: 67
- Detecting Aws Guardduty Findings AutomationBuild automated AWS GuardDuty finding response pipelines using EventBridgeVotes: 0GitHub stars: 67
- Detecting Aws Credential Exposure With Trufflehog'Scan source code repositories, CI/CD pipelines, and configuration filesVotes: 0GitHub stars: 67
- Detecting Aws Cloudtrail AnomaliesDetect unusual API call patterns in AWS CloudTrail logs using boto3,Votes: 0GitHub stars: 67
- Detecting Arp Poisoning In Network TrafficDetect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARPVotes: 0GitHub stars: 67
- Deploying Tailscale For Zero Trust VpnDeploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.Votes: 0GitHub stars: 67
- Deploying Software Defined PerimeterDeploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based "invisible" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access.Votes: 0GitHub stars: 67
- Deploying Palo Alto Prisma Access Zero TrustDeploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.Votes: 0GitHub stars: 67
- Deploying Osquery For Endpoint Monitoring'Deploys and configures osquery for real-time endpoint monitoring usingVotes: 0GitHub stars: 67
- Deploying Edr Agent With Crowdstrike'Deploys and configures CrowdStrike Falcon EDR agents across enterpriseVotes: 0GitHub stars: 67
- Deploying Cloudflare Access For Zero TrustDeploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.Votes: 0GitHub stars: 67
- Deploying Active Directory Honeytokens'Deploys deception-based honeytokens in Active Directory including fakeVotes: 0GitHub stars: 67
- Correlating Security Events In Qradar'Correlates security events in IBM QRadar SIEM using AQL (Ariel QueryVotes: 0GitHub stars: 67
- Configuring Zscaler Private Access For Ztna'Configures Zscaler Private Access (ZPA) to replace traditional VPNVotes: 0GitHub stars: 67