Skill UI

Guides security teams through deploying Amazon GuardDuty with protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting findings, and wiring EventBridge plus Lambda for automated responses across AWS accounts.

Detect unauthorized modifications to running containers by monitoring binary execution, filesystem writes, configuration changes, and package activity, using Falco rules and Kubernetes policies to maintain immutable workloads.

Detects container escape attempts via runtime monitoring using Falco, Sysdig, and custom audit rules. Monitors syscalls, mounts, kernel modules, and Docker socket accesses so SOC teams can hunt escapes and validate detection coverage.

Implements cloud workload protection using boto3 and google-cloud APIs for runtime monitoring, anomaly detection, file integrity checks, and resource audits to hunt cryptominers, reverse shells, and unauthorized binaries on EC2 and GCE workloads.

Hardens managed Kubernetes clusters on EKS, AKS, and GKE through Pod Security Standards, namespace network policies, workload identity bindings, RBAC scoping, image admission controls, and runtime security monitoring for production compliance.

Detects and prevents code injection in serverless functions by combining static code analysis, CloudTrail correlation, IAM auditing, and runtime monitoring to surface poisoned event sources, malicious layers, and privilege escalation across Lambda, Azure, and Google Cloud deployments.