Claude Configs

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.

Implement GitOps with ArgoCD for declarative Kubernetes deployments.

'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

'Analyzes indicators of compromise (IOCs) including IP addresses, domains,

'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

'Analyzes network traffic generated by malware during sandbox execution

'Captures and analyzes network packet data using Wireshark and tshark

'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

'Leverages Splunk Enterprise Security and SPL (Search Processing Language)

'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s

'Analyzes Windows Security, System, and Sysmon event logs in Splunk to

Extract and analyze Windows Registry hives with tools like RegRipper

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

'Systematically audit AWS S3 bucket permissions to identify publicly

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to

'Auditing Terraform infrastructure-as-code for security misconfigurations

Build effective detection rules using Splunk Search Processing Language

'Builds vendor-agnostic detection rules using the Sigma rule format for

'Builds real-time incident response dashboards in Splunk, Elastic, or

Designs and documents structured incident response playbooks with step-by-step

Build collaborative forensic incident timelines using Timesketch to ingest,

Build structured communication templates for malware incidents (ransomware,

Establish a repeatable operational process for triaging, testing, and

Builds a structured ransomware incident response playbook aligned with

Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB

Apply bottom-up and top-down role mining techniques, including clustering

'Builds SOC performance metrics and KPI tracking dashboards measuring

'Builds a structured SOC incident response playbook for ransomware attacks

Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,

'Builds automated threat intelligence feed integration pipelines connecting

Discovering and accessing unprotected pages, APIs, and administrative

'Systematically collects, categorizes, and distributes indicators of

Execute an internal network penetration test simulating an insider threat

'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap

'Performs memory forensics analysis using Volatility 3 to extract evidence

Facilitate structured post-incident reviews to identify root causes,

'Configures host-based intrusion detection systems (HIDS) to monitor

'Configures Windows Event Logging with advanced audit policies to generate

'Configures Zscaler Private Access (ZPA) to replace traditional VPN

'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query

'Deploys deception-based honeytokens in Active Directory including fake

'Deploys canary files (honeytokens) across file systems to detect ransomware

'Deploys and configures CrowdStrike Falcon EDR agents across enterprise

'Deploys and configures osquery for real-time endpoint monitoring using