メニュー
SkillsMP は transilienceai/transilience-mdr-rainer から 23 件の skill を収集しています。skill を開くとソースと詳細を確認できます。
収集済み skill 23 件中 23 件を表示しています。
Rank AWS remediations by how many attack chains each one severs, so a team gets maximum blast-radius reduction per fix. Use when you have an aws_attack_chains/v1 file from the chain enumerator and need to turn it into a prioritized "biggest bang for the buck"…
原文の言語: 英語
Traverse a merged aws_attack_model/v1 attack graph and emit aws_attack_chains/v1 - ranked kill chains from an entry (internet or a single stolen credential) to crown jewels, the atomic technique catalog of attack primitives actually present, and root causes…
原文の言語: 英語
Merge one or more aws_attack_model/v1 envelopes from the AWS attack-surface / identity-trust / crown-jewel / active-threat collectors into a single, de-duplicated attack graph ready for chain enumeration. Use when combining multiple collector outputs into one…
原文の言語: 英語
Extensible AWS attack-primitive knowledge base that maps a misconfiguration signature to an attack primitive, its MITRE ATT&CK technique and tactic, what it enables downstream, and its remediation. Use when you need to tag attack-model findings/nodes/edges…
原文の言語: 英語
Collects the internet-facing AWS exposure that standard CSPM baselines routinely miss and emits it as an aws_attack_model/v1 envelope for the red-team attack-chain suite. Use when you need to enumerate public EBS snapshots, public AMIs, public or…
原文の言語: 英語
Enumerate and RANK the high-value AWS targets (crown jewels) an attacker would aim at, plus the connectivity edges that reach them, and emit them in the shared aws_attack_model/v1 contract. Classifies S3 buckets, databases (RDS/Redshift/DocumentDB/DynamoDB),…
原文の言語: 英語
Deep AWS IAM, identity, and trust-relationship collector that goes further than a user-centric access-key report so future runs automatically surface privilege escalation and cross-account pivots. Collects per account IAM users, roles, groups with attached…
原文の言語: 英語
Package an enumerated AWS attack-chain model into customer-facing red-team reports — a Markdown attack-chain catalog and a Transilience-styled dark-theme PDF. Use as the FINAL stage of the AWS red-team attack-chain suite, after aws-attack-graph-builder has…
原文の言語: 英語
Correlate live AWS GuardDuty findings and investigation evidence onto a static attack-chain model, so theoretical chains that are actually under attack right now light up. Use when you have an aws_attack_chains/v1 file from the chain enumerator and want to…
原文の言語: 英語
Collect reproducible AWS CloudTrail management events through CloudTrail LookupEvents. Use when making live AWS CloudTrail calls across accounts, roles, regions, event names, and time windows, especially when the output must include exact boto3 parameters,…
原文の言語: 英語
Normalize AWS CloudTrail records into a stable business-analysis observation schema. Use when working with CloudTrail LookupEvents output, raw CloudTrail JSON, CloudTrail JSONL, QRadar decoded_payload records, evidence-pack wrappers, actor/source-IP/event…
原文の言語: 英語
Export Google Workspace Admin Reports and customer usage evidence with the gws CLI for security reviews, shadow AI detection, OAuth investigation, Drive sharing analysis, login risk review, Gemini Workspace usage review, and weekly Google Workspace audit…
原文の言語: 英語
Build business-as-usual baselines from normalized AWS CloudTrail observations. Use when analyzing AWS control-plane activity to understand normal business operations, actor/event/source-IP tuples, account behavior, application communication patterns, CI/CD…
原文の言語: 英語
Generate portable AWS CloudTrail detection specifications from a CloudTrail business baseline, normalized observations, or evidence pack. Use for alert logic covering root activity, access-key creation, IAM role/policy writes, unmanaged egress,…
原文の言語: 英語
Detect and triage shadow AI usage from AWS VPC Flow Logs, including model-provider egress, Bedrock-adjacent runtime evidence, RAG/vector traffic, model downloads, internal inference services, model brokers, LLM observability, and agent-like timing or fanout…
原文の言語: 英語
Detect and triage shadow AI usage from Git repositories and source trees, including model/provider SDKs, agent frameworks, MCP configs, prompts, RAG/vector stores, eval or training artifacts, CI/CD AI usage, AI supply-chain dependencies, and secret-name…
原文の言語: 英語
Detect and triage employee shadow AI usage from Google Workspace Admin Reports evidence, including OAuth token grants, access evaluation events, Gemini Workspace app utilization, AI-related application names, broad Google scopes, and admin OAuth app-control…
原文の言語: 英語
Convert AWS CloudTrail event clusters, baselines, detection candidates, or evidence packs into business-context triage findings. Use when explaining what happened, why it likely happened, whether it looks like business-as-usual, what residual risk remains,…
原文の言語: 英語
Package actual raw AWS CloudTrail events into reproducible evidence bundles. Use when extracting CloudTrail records from LookupEvents output, CloudTrail JSON/JSONL, QRadar or SIEM decoded_payload fields, or investigation case filters, and when the report must…
原文の言語: 英語
Build concise VPC Flow Log AI security reports from shadow-ai-aws-vpc-flow outputs, including model-provider egress, RAG/vector candidates, agent-like fanout, Bedrock events, internal inference indicators, confidence levels, limitations, and remediation…
原文の言語: 英語
Package AWS CloudTrail baselines, evidence packs, detection specs, and business triage into customer-facing reports. Use when producing Markdown or PDF-ready reports that need executive summaries, finding cards, remediation roadmaps, evidence appendices,…
原文の言語: 英語
Build concise Git shadow-AI security reports from shadow-ai-git outputs, including models and providers, agent frameworks, MCP tooling, prompts, RAG/vector usage, training or eval artifacts, AI supply-chain dependencies, CI/CD usage, confidence levels, and…
原文の言語: 英語
Build concise weekly Google Workspace security reports from exported Admin Reports and customer usage evidence, including shadow AI OAuth activity, Gemini Workspace usage, Drive external exposure, login risk, admin configuration changes, and configuration…
原文の言語: 英語