Skill UI

Guides security teams through deploying Amazon GuardDuty with protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting findings, and wiring EventBridge plus Lambda for automated responses across AWS accounts.

Detects and prevents privilege escalation for Kubernetes pods by combining admission policies (Pod Security Admission, OPA Gatekeeper) and runtime monitoring (Falco) to watch security contexts, capabilities, syscalls, and audit logs for privileged containers, host namespace access, or dangerous capabilities.

Automates runtime threat monitoring across EC2 and GCE workloads, using boto3 and Google Cloud APIs to inspect processes, network connections, file hashes, and resource spikes for cryptomining, reverse shells, and unauthorized binaries.

Implements eBPF-powered runtime security monitoring and enforcement for Kubernetes via Cilium Tetragon, covering tracing policies, enforcement actions, CLI workflows, and integrations to detect container escapes, sensitive file access, and crypto mining attempts.

Hardens managed Kubernetes clusters on EKS, AKS, and GKE through Pod Security Standards, namespace network policies, workload identity bindings, RBAC scoping, image admission controls, and runtime security monitoring for production compliance.