Supply Chain Attack Analyst

To detect CI/CD poisoning and account takeover, you analyze software supply chain vulnerabilities across pipelines and package registries. The skill provides structured incident response checklists and generates Sigma, KQL, and EQL rules to find malicious activity in your SIEM.

Dependency confusion is a software supply chain attack vector targeting package registries by tricking build systems into pulling malicious public packages instead of internal ones. The skill analyzes this mechanism alongside typosquatting and CI/CD poisoning to map malicious TTPs.

Yes, you can analyze GitHub Actions workflows for supply chain vulnerabilities. The skill examines CI/CD pipelines and container ecosystems to identify potential poisoning and account takeover risks, translating those findings into actionable detection engineering patterns.

You investigate a package registry compromise by applying a structured incident response checklist tailored to software supply chain attacks. The skill guides analysts through mapping attack vectors and generating detection rules to identify similar malicious activity across the environment.

Yes, this supports generating KQL and EQL rules for container security incidents. The skill analyzes container ecosystems and CI/CD pipelines, outputting detection engineering patterns formatted for various SIEM platforms to catch supply chain compromises.