Security
4,732 results
- Implementing Secrets Management With VaultMahipalDeploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration.
- Implementing Security Chaos EngineeringMahipalImplements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.
- Implementing Security Information Sharing With Stix2MahipalCreate, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1. Use when building or exchanging structured threat intelligence, modeling relationships between threat objects, or publishing/consuming a TAXII 2.1 feed.
- Implementing Security Monitoring With DatadogMahipalImplements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment, log source ingestion, detection rule creation, security dashboards, and automated notification workflows.
- Implementing Semgrep For Custom Sast RulesMahipalWrite custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
- Implementing Siem Use Cases For DetectionMahipalImplements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
- Implementing Sigstore For Software SigningMahipalImplements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts, including OIDC-based identity binding and CI/CD pipeline integration.
- Implementing Soar Automation With PhantomMahipalImplements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.
- Implementing Soar Playbook With Palo Alto XsoarMahipalBuild automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools.
- Implementing Stix Taxii Feed IntegrationMahipalImplements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion.
- Implementing Supply Chain Security With In TotoMahipalImplements supply chain integrity verification for container builds with the in-toto framework: generating signing keys, defining a supply chain layout, recording pipeline steps as signed link metadata, verifying before deployment, enforcing at Kubernetes admission, and integrating with SLSA.
- Implementing Taxii Server With OpentaxiiMahipalDeploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for automated indicator exchange between organizations. Use when standing up a TAXII server to share threat intel, configuring collections for CTI feeds, or automating STIX indicator ingestion into a SIEM/SOAR.
- Implementing Threat Intelligence Lifecycle ManagementMahipalBuild out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback), including defining intelligence requirements, building a collection pipeline, normalizing data, and tracking dissemination feedback.
- Implementing Threat Modeling With Mitre AttackMahipalImplements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.
- Implementing Usb Device Control PolicyMahipalImplements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
- Implementing Velociraptor For Ir CollectionMahipalDeploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
- Implementing Vulnerability Management With GreenboneMahipalDeploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library over the Greenbone Management Protocol (GMP) to connect via Unix socket or TLS, create scan targets and configs, execute scans, and parse the XML scan reports into actionable findings.
- Implementing Vulnerability Remediation SlaMahipalDesign a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception processes, escalation chains, ticketing-system integration, and remediation KPIs/trending metrics. Use when defining mandatory patching timeframes by severity and asset criticality, building an SLA policy document, or setting up escalation and KPI tracking for vulnerability remediation.
- Implementing Vulnerability Sla Breach AlertingMahipalBuild an automated SLA breach alerting system for vulnerability remediation, including a database schema for SLA tracking, breach detection logic, notification dispatch, a scheduled check runner, and a KPI/compliance metrics dashboard.
- Implementing Web Application Logging With ModsecurityMahipalConfigure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.
- Implementing Zero Standing Privilege With CyberarkMahipalDeploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals).
- Implementing Zero Trust Dns With NextdnsMahipalConfigure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints.
- Implementing Zero Trust For Saas ApplicationsMahipalSecures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA/device-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data.
- Implementing Zero Trust In CloudMahipalGuides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment.