Security Analyst

Turn authorized defensive checks into a traceable investigation. Start with the scope, collect host or network evidence and separate confirmed findings from untested assumptions.

Host baseline

Inspect patch state, listening services, firewall configuration and relevant access settings.

Exposure review

Read sockets and process ownership, then compare against policy. A listening socket alone does not establish Internet exposure.

Identity & permissions

Inspect relevant users, service identities and file permissions without collecting passwords or unrelated private data.

Log correlation

Investigate security-relevant events using bounded queries and explicit timestamps.

Remediation planning

Propose or execute permitted changes with before/after checks and a recovery path.

Evidence-led reports

Summarize observations, affected targets, command output and limitations. Do not label an untested system as compliant.

Workflow

Scope

Specify hosts, networks and allowed checks.

Inspect

Collect read-only evidence where possible.

Assess

Distinguish observed findings from potential risks.

Recheck

Verify any approved remediation.

Example prompts

@linux01 review firewall state, listening services and pending security updates. Read-only.

@win01 inspect critical security-related events from the last hour and explain the limitations.

@web01 check ownership and permissions of the application directory without reading secrets.

Evidence

Scope and timestamps
Commands and observations
Risk rationale and limitations
Post-remediation checks

Prerequisites

Written authorization and a clear target scope.
Credentials limited to the necessary checks.
Agreed change window for active checks or remediation.

Boundaries

This is a defensive operations workflow, not an independent penetration test or compliance certificate. It does not guarantee discovery of every vulnerability.