AgentFlocks/flocks - Página 20

testing-ransomware-recovery-procedures

Test and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.

Idioma do texto original: inglês

testing-websocket-api-security

Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via…

Idioma do texto original: inglês

tracking-threat-actor-infrastructure

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

Idioma do texto original: inglês

triaging-security-alerts-in-splunk

Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts…

Idioma do texto original: inglês

triaging-security-incident

Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate…

Idioma do texto original: inglês

triaging-security-incident-with-ir-playbook

Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.

Idioma do texto original: inglês

triaging-vulnerabilities-with-ssvc-framework

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.

Idioma do texto original: inglês

validating-backup-integrity-for-recovery

Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.

Idioma do texto original: inglês

ndr-alert-analysis

用于 NDR（网络检测与响应）告警的自动化研判分析，按照标准流程进行情报查询、资产关联、漏洞分析、payload 解析和综合研判。

Idioma do texto original: chinês

onboarding

Guide new users through the complete Flocks setup process via conversation — covering ThreatBook MCP/API, security tool APIs, IM channels, and scenario demos. Also runs system health inspection for returning users. Trigger when the user sends "请启动新手引导流程",…

Idioma do texto original: Vários idiomas

ndr-alert-analysis

用于 NDR（网络检测与响应）告警的自动化研判分析，按照标准流程进行情报查询、资产关联、漏洞分析、payload 解析和综合研判。

Idioma do texto original: chinês