Menú
SkillsMP ha recopilado 9 skills de aws-samples/sample-sentinel-harness. Abre una skill para revisar su origen y sus detalles.
Mostrando 9 de 9 skills recopiladas.
Standard operating procedure for writing a Sigma or YARA detection rule and self-checking it before it goes to adversarial review. Use when authoring a new detection for a technique, log source, or malware family. Covers hypothesis framing, choosing Sigma vs…
Idioma del texto original: inglés
General true-positive / false-positive alert triage rubric for a SOC analyst. Use when any SIEM alert needs a disposition and the analyst must corroborate the signal across siem_query, asset_lookup, and enrich_ioc, assign a severity, decide…
Idioma del texto original: inglés
Standard operating procedure for correlating a single CVE to the specific assets it affects and computing the blast radius across the estate. Use when a CVE lands and the question is not just "how bad is it" but "which of MY hosts are actually affected, how…
Idioma del texto original: inglés
Standard operating procedure for opening and annotating a security incident ticket at the end of a triage flow. Use when a triaged finding needs to be recorded as a ticket so a human can own containment and remediation. Covers the create_ticket field…
Idioma del texto original: inglés
Standard operating procedure for triaging security/operations findings across a multi-account estate. Use when posture or ops findings arrive from several accounts and an analyst must query them with ops_query, decide which findings are noise versus which…
Idioma del texto original: inglés
Standard operating procedure for triaging a single suspicious IP address in a SOC. Use when an IP arrives from an alert, firewall log, or threat feed and an analyst must decide whether it is malicious, whether it touched any asset in the estate, and whether…
Idioma del texto original: inglés
Standard operating procedure for reasoning about attack paths from exposed assets using the MITRE ATT&CK framework. Use when analyzing how an adversary could move from an internet-facing or exposed asset toward crown-jewel targets, to enumerate plausible…
Idioma del texto original: inglés
Standard operating procedure for triaging the impact of a CVE for a security operations team. Use when assessing a CVE's severity, exploitability, and asset impact, and deciding whether to patch, mitigate, monitor, or take no action. Combines CVSS, EPSS, and…
Idioma del texto original: inglés
Standard operating procedure for vetting an indicator of compromise (file hash, domain, or IP address) before acting on it. Use when an IOC arrives from an alert, threat feed, or report and needs a reputation lookup, a confidence rating, and false-positive…
Idioma del texto original: inglés