Incident responseThreat huntingDetection rules creations in Microsoft EDRDetection rules creations in basic ELKCreations test-lab infrastructure for starts suspicious files and making detectImplementing a network traffic analyzer (Arkime). Wrote one topic with my lead https://habr.com/ru/post/676174/I was a speaker at PhDhttps://phdays.com/broadcast/?tag=defense&talk=291

Creation SOC roadmap Writing content for Elastic SIEMBegan to create an incident response processStarted fixing the logging policy by creating a configuration for AD GPO audit, sysmon, auditd.

Infrastructure as Code (terraform, yandex cli, GitLab). Create test infrastructure, create active directory in Yandex Cloud, setting GPO, NXlog collector, log shipment for SIEM.Piloting SIEM, conducting synthetic tests on deployed infrastructure.Python, automation of routine tasks.Kibana, create dashboards for monitoring illegal actions activity in applications, fraud detection.Participation in the investigation of fraud incidents.

Monitoring incident of information security, triage, investigation.Write custom alerting rule in SIEM. Create visualizations and dashboards in Kibana.Incident response. Investigation of APT attack.Powershell, write script for automatization part of triage.Python, integration SOAR system with telegram-bot by API for making report. Using regular expressions and json configuration.

Installation and configuration EDR.Log shipment for SIEM.Write runbooks and other documentations.