#automation
All CosmicBytez Labs articles tagged #automation, across news, security advisories, how-to guides, and projects.
- News
Why Patch Automation Needs Brakes, Not Just an Accelerator
Automation can spread a bad patch as fast as a good one. Action1's Field CTO explains how update rings, success criteria, and human oversight add control.
- News
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
A high-severity expression sandbox escape in n8n allows authenticated workflow editors to execute operating-system commands on the host server. Security...
- Project
Nuclei Vulnerability Scanning Pipeline
Build an automated vulnerability scanning pipeline using ProjectDiscovery's Nuclei and companion tools — subfinder, httpx, and naabu — to continuously...
- Project
Claude Code for IT Operations: Building a Multi-Project
Transform Claude Code from a chatbot into a DevOps co-pilot. Set up CLAUDE.md templates, custom hooks, reusable agents, deployment skills, and MCP server...
- Project
Securing AI-Assisted Development with Claude Code
Build guardrails around AI-generated code with Claude Code hooks, security-scanning agents, OWASP-aware prompting, and automated secret detection. A...
- HOWTO
How to Configure Microsoft Sentinel Analytics Rules
End-to-end SOC guide for Microsoft Sentinel: build KQL-based scheduled and NRT analytics rules, wire automation rules for incident triage, and deploy...
- HOWTO
SentinelOne Application Control Policies
Organizations face security risks from unauthorized applications, malware disguised as legitimate software, and shadow IT installations that bypass...
- HOWTO
SentinelOne Control vs Complete Feature Comparison
This document provides a comprehensive comparison between SentinelOne Singularity Control and Singularity Complete SKUs to help MSP teams understand the...
- HOWTO
SentinelOne Create and Manage Exclusion Policies
SentinelOne exclusion policies allow security teams to prevent false-positive detections and performance issues by excluding specific files, folders,...
- HOWTO
SentinelOne Data Retention and Storage Management
Organizations using SentinelOne Singularity Complete receive 14-365+ days of Deep Visibility EDR data retention by default. This historical telemetry...
- HOWTO
SentinelOne Deep Visibility Threat Hunting
Deep Visibility is SentinelOne's EDR telemetry engine that provides comprehensive endpoint data collection for threat hunting, incident investigation, and...
- HOWTO
SentinelOne Deploy Agent Manual Installation
Manual SentinelOne agent installation is used when automated deployment methods (GPO, RMM, SCCM) are unavailable or when installing on standalone...
- HOWTO
SentinelOne Deploy Agent via Group Policy
Deploying SentinelOne agents across Windows endpoints at scale using Active Directory Group Policy Objects (GPO) enables centralized, automated agent...
- HOWTO
Deploy SentinelOne Policy
Deploy, manage, and validate SentinelOne security policies across your endpoint estate using the SentinelOne Management API. This automated workflow supports:
- HOWTO
SentinelOne Device Control: Block USB & Bluetooth Devices
How to block USB drives and Bluetooth peripherals with SentinelOne Device Control — audit in Monitor mode, then enforce allow/block policies safely.
- HOWTO
SentinelOne File Fetch and Forensic File Collection
During threat investigations, security analysts need to retrieve suspicious files from endpoints for deeper forensic analysis. Traditional methods...
- HOWTO
SentinelOne Firewall Control Management
Traditional endpoint protection focuses on file-based malware, but network-based attacks (lateral movement, command-and-control callbacks, port scanning,...
- HOWTO
SentinelOne Forensics Rollback and Remediation
This document provides comprehensive procedures for forensic evidence collection, ransomware rollback, and threat remediation using SentinelOne Complete...
- HOWTO
SentinelOne Health Check: Agent Status Monitoring Guide
Organizations deploying SentinelOne endpoint protection require continuous monitoring of agent health to ensure comprehensive threat coverage across their...
- HOWTO
Invoke SentinelOne Threat Hunt
Proactive threat hunting is essential for identifying sophisticated threats that evade automated detection systems. This script automates the process of...
- HOWTO
SentinelOne MITRE ATT&CK Threat Hunting
The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in...
- HOWTO
SentinelOne MSP Client Onboarding
This runbook provides a standardized process for onboarding new MSP clients to SentinelOne Singularity Complete. Following this methodology ensures...
- HOWTO
SentinelOne Policy Configuration Best Practices
This guide provides comprehensive best practices for configuring SentinelOne policies in MSP environments managing multiple client sites with Singularity...
- HOWTO
SentinelOne PowerShell API Automation
The SentinelOne Management Console REST API enables automation of administrative tasks, reporting, threat response, and integration with existing security...
- HOWTO
SentinelOne PowerShell Automation Scripts
This document provides a comprehensive library of production-ready PowerShell scripts for automating SentinelOne operations in an MSP environment. These...
- HOWTO
SentinelOne Purple AI Usage Guide
Security Operations Centers (SOCs) face overwhelming alert volumes, complex threat investigations, and resource constraints. Analysts spend hours writing...
- HOWTO
SentinelOne Ranger Network Discovery and IoT Visibility
Modern enterprise networks contain a complex mix of managed endpoints (workstations, servers), IoT devices (IP cameras, printers, smart building systems),...
- HOWTO
SentinelOne Remote Shell Operations
Full Remote Shell is a SentinelOne Complete feature that provides authorized administrators with secure, native command-line access to managed endpoints...
- HOWTO
SentinelOne RMM Integration Guide
This runbook provides comprehensive guidance for integrating SentinelOne Singularity Complete with NinjaRMM and other RMM platforms. Proper RMM...
- HOWTO
SentinelOne Sandbox Integration Configuration
SentinelOne detects suspicious files but automated malware analysis requires sandbox integration. Manually uploading files to VirusTotal, Joe Sandbox, or...
- HOWTO
SentinelOne STAR Advanced Automation and Watchlists
Security teams face the challenge of detecting organization-specific threats, insider threats, and policy violations that generic detection rules cannot...
- HOWTO
SentinelOne STAR Custom Detection Rules
Storyline Active Response (STAR) is SentinelOne's cloud-based automated hunting, detection, and response engine that allows security teams to create...
- HOWTO
SentinelOne Threat Investigation Workflow
When SentinelOne detects a threat on an endpoint, security analysts must quickly investigate the alert to determine if it's a genuine malware infection,...
- HOWTO
SentinelOne Timeline Forensics and Attack Chain Analysis
Understanding the complete attack chain requires correlating hundreds of events (process creation, network connections, file modifications, registry...
- HOWTO
Automating Report Generation with Python and Jinja2
Build an automated report generation system using Python, Jinja2 templates, and data extraction from multiple sources. Covers multi-tenant data...
- HOWTO
IT Service Dashboards with PowerShell Universal
Build interactive IT service management dashboards using PowerShell Universal. Create real-time client portals, automated ticketing views, and...
- HOWTO
Automated News Aggregation with Deduplication Algorithms
Build a news aggregation system that fetches from multiple RSS feeds, detects duplicate articles using Jaccard similarity, and generates clean...
- HOWTO
NinjaOne Scripting: PowerShell Automation Library
Build a comprehensive PowerShell automation library for NinjaOne RMM. Covers script library setup, custom fields, scheduled scripts, and condition-based...
- Project
CI/CD Pipeline with GitHub Actions and Azure
Build a secure CI/CD pipeline with GitHub Actions deploying to Azure. Covers build, test, security scanning (SAST/DAST), and deployment with OIDC...
- Project
NinjaOne RMM Platform Setup
Complete NinjaOne implementation - organization setup, policies, scripting, alerting, patch management, and documentation integration.
- Project
SentinelOne Complete Deployment Guide
Full deployment lifecycle for SentinelOne EDR - agent rollout, policy configuration, exclusions, threat hunting queries, and response playbooks.