Menú
SkillsMP ha recopilado 23 skills de transilienceai/transilience-mdr-rainer. Abre una skill para revisar su origen y sus detalles.
Mostrando 23 de 23 skills recopiladas.
Rank AWS remediations by how many attack chains each one severs, so a team gets maximum blast-radius reduction per fix. Use when you have an aws_attack_chains/v1 file from the chain enumerator and need to turn it into a prioritized "biggest bang for the buck"…
Idioma del texto original: inglés
Traverse a merged aws_attack_model/v1 attack graph and emit aws_attack_chains/v1 - ranked kill chains from an entry (internet or a single stolen credential) to crown jewels, the atomic technique catalog of attack primitives actually present, and root causes…
Idioma del texto original: inglés
Merge one or more aws_attack_model/v1 envelopes from the AWS attack-surface / identity-trust / crown-jewel / active-threat collectors into a single, de-duplicated attack graph ready for chain enumeration. Use when combining multiple collector outputs into one…
Idioma del texto original: inglés
Extensible AWS attack-primitive knowledge base that maps a misconfiguration signature to an attack primitive, its MITRE ATT&CK technique and tactic, what it enables downstream, and its remediation. Use when you need to tag attack-model findings/nodes/edges…
Idioma del texto original: inglés
Collects the internet-facing AWS exposure that standard CSPM baselines routinely miss and emits it as an aws_attack_model/v1 envelope for the red-team attack-chain suite. Use when you need to enumerate public EBS snapshots, public AMIs, public or…
Idioma del texto original: inglés
Enumerate and RANK the high-value AWS targets (crown jewels) an attacker would aim at, plus the connectivity edges that reach them, and emit them in the shared aws_attack_model/v1 contract. Classifies S3 buckets, databases (RDS/Redshift/DocumentDB/DynamoDB),…
Idioma del texto original: inglés
Deep AWS IAM, identity, and trust-relationship collector that goes further than a user-centric access-key report so future runs automatically surface privilege escalation and cross-account pivots. Collects per account IAM users, roles, groups with attached…
Idioma del texto original: inglés
Package an enumerated AWS attack-chain model into customer-facing red-team reports — a Markdown attack-chain catalog and a Transilience-styled dark-theme PDF. Use as the FINAL stage of the AWS red-team attack-chain suite, after aws-attack-graph-builder has…
Idioma del texto original: inglés
Correlate live AWS GuardDuty findings and investigation evidence onto a static attack-chain model, so theoretical chains that are actually under attack right now light up. Use when you have an aws_attack_chains/v1 file from the chain enumerator and want to…
Idioma del texto original: inglés
Collect reproducible AWS CloudTrail management events through CloudTrail LookupEvents. Use when making live AWS CloudTrail calls across accounts, roles, regions, event names, and time windows, especially when the output must include exact boto3 parameters,…
Idioma del texto original: inglés
Normalize AWS CloudTrail records into a stable business-analysis observation schema. Use when working with CloudTrail LookupEvents output, raw CloudTrail JSON, CloudTrail JSONL, QRadar decoded_payload records, evidence-pack wrappers, actor/source-IP/event…
Idioma del texto original: inglés
Export Google Workspace Admin Reports and customer usage evidence with the gws CLI for security reviews, shadow AI detection, OAuth investigation, Drive sharing analysis, login risk review, Gemini Workspace usage review, and weekly Google Workspace audit…
Idioma del texto original: inglés
Build business-as-usual baselines from normalized AWS CloudTrail observations. Use when analyzing AWS control-plane activity to understand normal business operations, actor/event/source-IP tuples, account behavior, application communication patterns, CI/CD…
Idioma del texto original: inglés
Generate portable AWS CloudTrail detection specifications from a CloudTrail business baseline, normalized observations, or evidence pack. Use for alert logic covering root activity, access-key creation, IAM role/policy writes, unmanaged egress,…
Idioma del texto original: inglés
Detect and triage shadow AI usage from AWS VPC Flow Logs, including model-provider egress, Bedrock-adjacent runtime evidence, RAG/vector traffic, model downloads, internal inference services, model brokers, LLM observability, and agent-like timing or fanout…
Idioma del texto original: inglés
Detect and triage shadow AI usage from Git repositories and source trees, including model/provider SDKs, agent frameworks, MCP configs, prompts, RAG/vector stores, eval or training artifacts, CI/CD AI usage, AI supply-chain dependencies, and secret-name…
Idioma del texto original: inglés
Detect and triage employee shadow AI usage from Google Workspace Admin Reports evidence, including OAuth token grants, access evaluation events, Gemini Workspace app utilization, AI-related application names, broad Google scopes, and admin OAuth app-control…
Idioma del texto original: inglés
Convert AWS CloudTrail event clusters, baselines, detection candidates, or evidence packs into business-context triage findings. Use when explaining what happened, why it likely happened, whether it looks like business-as-usual, what residual risk remains,…
Idioma del texto original: inglés
Package actual raw AWS CloudTrail events into reproducible evidence bundles. Use when extracting CloudTrail records from LookupEvents output, CloudTrail JSON/JSONL, QRadar or SIEM decoded_payload fields, or investigation case filters, and when the report must…
Idioma del texto original: inglés
Build concise VPC Flow Log AI security reports from shadow-ai-aws-vpc-flow outputs, including model-provider egress, RAG/vector candidates, agent-like fanout, Bedrock events, internal inference indicators, confidence levels, limitations, and remediation…
Idioma del texto original: inglés
Package AWS CloudTrail baselines, evidence packs, detection specs, and business triage into customer-facing reports. Use when producing Markdown or PDF-ready reports that need executive summaries, finding cards, remediation roadmaps, evidence appendices,…
Idioma del texto original: inglés
Build concise Git shadow-AI security reports from shadow-ai-git outputs, including models and providers, agent frameworks, MCP tooling, prompts, RAG/vector usage, training or eval artifacts, AI supply-chain dependencies, CI/CD usage, confidence levels, and…
Idioma del texto original: inglés
Build concise weekly Google Workspace security reports from exported Admin Reports and customer usage evidence, including shadow AI OAuth activity, Gemini Workspace usage, Drive external exposure, login risk, admin configuration changes, and configuration…
Idioma del texto original: inglés