[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADT3ABQM1B9ATPBK1PYRMN":3,"skill-same:01M6ADT3ABQM1B9ATPBK1PYRMN":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6ADT3ABQM1B9ATPBK1PYRMN","analyzing-threat-intelligence-feeds",null,"Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"threat intelligence","analyzing threat intelligence feeds","analyzing","threat-intelligence","cti","ioc","stix","attribution","MITRE-ATT&CK","NIST-CSF","MISP","campaign attribution","data","TAXII","ThreatConnect","Recorded-Future","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-threat-intelligence-feeds\ndescription: 'Analyzes structured and unstructured threat intelligence feeds to extract\n  actionable indicators, adversary tactics, and campaign context. Use when ingesting\n  commercial or open-source CTI feeds, evaluating feed quality, normalizing data into\n  STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates\n  for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP,\n  AlienVault OTX, or automated feed aggregation pipelines.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- STIX\n- TAXII\n- MITRE-ATT&CK\n- IOC\n- ThreatConnect\n- Recorded-Future\n- MISP\n- CTI\n- NIST-CSF\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1071.001\n- T1566\n- T1568\n- T1583.001\n- T1102\n---\n# Analyzing Threat Intelligence Feeds\n\n## When to Use\n\nUse this skill when:\n- Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio\n- Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema\n- Evaluating feed freshness, fidelity, and relevance to the organization's threat profile\n- Building automated enrichment pipelines that correlate IOCs against SIEM events\n\n**Do not use** this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.\n\n## Prerequisites\n\n- Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI\n- API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)\n- TAXII 2.1 client library (taxii2-client Python package or equivalent)\n- Role with read\u002Fwrite permissions to the TIP's indicator database\n\n## Workflow\n\n### Step 1: Enumerate and Prioritize Feed Sources\n\nList all available feeds categorized by type (commercial, government, ISAC, OSINT):\n- Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence\n- Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC\n- OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats\n\nScore each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information Sharing).\n\n### Step 2: Ingest via TAXII 2.1 or API\n\nFor TAXII-enabled feeds:\n```\ntaxii2-client discover https:\u002F\u002Ffeed.example.com\u002Ftaxii\u002F\ntaxii2-client get-collection --collection-id \u003Cid> --since 2024-01-01\n```\n\nFor REST API feeds (e.g., Recorded Future):\n- Query `\u002Fv2\u002Findicator\u002Fsearch` with `risk_score_min=65` to filter low-confidence IOCs\n- Apply rate limiting and exponential backoff for API resilience\n\n### Step 3: Normalize to STIX 2.1\n\nConvert each IOC to STIX 2.1 objects using the OASIS standard schema:\n- IP address → `indicator` object with `pattern: \"[ipv4-addr:value = '...']\"`\n- Domain → `indicator` with `pattern: \"[domain-name:value = '...']\"`\n- File hash → `indicator` with `pattern: \"[file:hashes.SHA-256 = '...']\"`\n\nAttach `relationship` objects linking indicators to `threat-actor` or `malware` objects. Use `confidence` field (0–100) based on source fidelity rating.\n\n### Step 4: Deduplicate and Enrich\n\nRun deduplication against existing TIP database using normalized value + type as composite key. Enrich surviving IOCs:\n- VirusTotal: detection ratio, sandbox behavior reports\n- PassiveTotal (RiskIQ): WHOIS history, passive DNS, SSL certificate chains\n- Shodan: banner data, open ports, geographic location\n\n### Step 5: Distribute to Consuming Systems\n\nExport enriched indicators via TAXII 2.1 push to SIEM (Splunk, Microsoft Sentinel), firewalls (Palo Alto XSOAR playbooks), and EDR platforms. Set TTL (time-to-live) per indicator type: IP addresses 30 days, domains 90 days, file hashes 1 year.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — OASIS standard JSON schema for CTI objects including indicators, threat actors, campaigns, and relationships |\n| **TAXII 2.1** | Trusted Automated eXchange of Intelligence Information — HTTPS-based protocol for sharing STIX content between servers and clients |\n| **IOC** | Indicator of Compromise — observable artifact (IP, domain, hash, URL) that indicates a system may have been breached |\n| **TLP** | Traffic Light Protocol — color-coded classification (RED\u002FAMBER\u002FGREEN\u002FWHITE) defining sharing restrictions for CTI |\n| **Confidence Score** | Numeric value (0–100 in STIX) reflecting the producer's certainty about an indicator's malicious attribution |\n| **Feed Fidelity** | Historical accuracy rate of a feed measured by true positive rate in production detections |\n\n## Tools & Systems\n\n- **ThreatConnect TC Exchange**: Aggregates 100+ commercial and OSINT feeds; provides automated playbooks for IOC enrichment\n- **MISP (Malware Information Sharing Platform)**: Open-source TIP supporting STIX\u002FTAXII; widely used by ISACs and government CERTs\n- **OpenCTI**: Open-source platform with native MITRE ATT&CK integration and graph-based relationship visualization\n- **Recorded Future**: Commercial feed with AI-powered risk scoring and real-time dark web monitoring\n- **taxii2-client**: Python library for TAXII 2.0\u002F2.1 client operations (pip install taxii2-client)\n- **PyMISP**: Python API for MISP feed management and IOC submission\n\n## Common Pitfalls\n\n- **IOC age staleness**: IP addresses and domains rotate frequently; applying 1-year-old IOCs generates false positives. Enforce TTL policies.\n- **Missing context**: Blocking an IOC without understanding the associated campaign or adversary can disrupt legitimate business traffic (e.g., CDN IPs shared with malicious actors).\n- **Feed overlap without deduplication**: Ingesting the same IOC from five feeds without deduplication inflates indicator counts and SIEM rule complexity.\n- **TLP violation**: Redistributing RED-classified intelligence outside authorized boundaries violates sharing agreements and trust relationships.\n- **Over-blocking on low-confidence indicators**: Indicators with confidence below 50 should trigger detection-only rules, not blocking, to avoid operational disruption.\n","# Analyzing Threat Intelligence Feeds\n\n## When to Use\n\nUse this skill when:\n- Ingesting new commercial or OSINT threat feeds and assessing their signal-to-noise ratio\n- Normalizing heterogeneous IOC formats (STIX 2.1, OpenIOC, YARA, Sigma) into a unified schema\n- Evaluating feed freshness, fidelity, and relevance to the organization's threat profile\n- Building automated enrichment pipelines that correlate IOCs against SIEM events\n\n**Do not use** this skill for raw packet capture analysis or live incident triage without first establishing a CTI baseline.\n\n## Prerequisites\n\n- Access to a Threat Intelligence Platform (TIP) such as ThreatConnect, MISP, or OpenCTI\n- API keys for at least one commercial feed (Recorded Future, Mandiant Advantage, or VirusTotal Enterprise)\n- TAXII 2.1 client library (taxii2-client Python package or equivalent)\n- Role with read\u002Fwrite permissions to the TIP's indicator database\n\n## Workflow\n\n### Step 1: Enumerate and Prioritize Feed Sources\n\nList all available feeds categorized by type (commercial, government, ISAC, OSINT):\n- Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intelligence\n- Government: CISA AIS (Automated Indicator Sharing), FBI InfraGard, MS-ISAC\n- OSINT: AlienVault OTX, Abuse.ch, PhishTank, Emerging Threats\n\nScore each feed on: update frequency, historical accuracy rate, coverage of your sector, and attribution depth. Use a weighted scoring matrix with criteria from NIST SP 800-150 (Guide to Cyber Threat Information Sharing).\n\n### Step 2: Ingest via TAXII 2.1 or API\n\nFor TAXII-enabled feeds:\n```\ntaxii2-client discover https:\u002F\u002Ffeed.example.com\u002Ftaxii\u002F\ntaxii2-client get-collection --collection-id \u003Cid> --since 2024-01-01\n```\n\nFor REST API feeds (e.g., Recorded Future):\n- Query `\u002Fv2\u002Findicator\u002Fsearch` with `risk_score_min=65` to filter low-confidence IOCs\n- Apply rate limiting and exponential backoff for API resilience\n\n### Step 3: Normalize to STIX 2.1\n\nConvert each IOC to STIX 2.1 objects using the OASIS standard schema:\n- IP address → `indicator` object with `pattern: \"[ipv4-addr:value = '...']\"`\n- Domain → `indicator` with `pattern: \"[domain-name:value = '...']\"`\n- File hash → `indicator` with `pattern: \"[file:hashes.SHA-256 = '...']\"`\n\nAttach `relationship` objects linking indicators to `threat-actor` or `malware` objects. Use `confidence` field (0–100) based on source fidelity rating.\n\n### Step 4: Deduplicate and Enrich\n\nRun deduplication against existing TIP database using normalized value + type as composite key. Enrich surviving IOCs:\n- VirusTotal: detection ratio, sandbox behavior reports\n- PassiveTotal (RiskIQ): WHOIS history, passive DNS, SSL certificate chains\n- Shodan: banner data, open ports, geographic location\n\n### Step 5: Distribute to Consuming Systems\n\nExport enriched indicators via TAXII 2.1 push to SIEM (Splunk, Microsoft Sentinel), firewalls (Palo Alto XSOAR playbooks), and EDR platforms. Set TTL (time-to-live) per indicator type: IP addresses 30 days, domains 90 days, file hashes 1 year.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX 2.1** | Structured Threat Information Expression — OASIS standard JSON schema for CTI objects including indicators, threat actors, campaigns, and relationships |\n| **TAXII 2.1** | Trusted Automated eXchange of Intelligence Information — HTTPS-based protocol for sharing STIX content between servers and clients |\n| **IOC** | Indicator of Compromise — observable artifact (IP, domain, hash, URL) that indicates a system may have been breached |\n| **TLP** | Traffic Light Protocol — color-coded classification (RED\u002FAMBER\u002FGREEN\u002FWHITE) defining sharing restrictions for CTI |\n| **Confidence Score** | Numeric value (0–100 in STIX) reflecting the producer's certainty about an indicator's malicious attribution |\n| **Feed Fidelity** | Historical accuracy rate of a feed measured by true positive rate in production detections |\n\n## Tools & Systems\n\n- **ThreatConnect TC Exchange**: Aggregates 100+ commercial and OSINT feeds; provides automated playbooks for IOC enrichment\n- **MISP (Malware Information Sharing Platform)**: Open-source TIP supporting STIX\u002FTAXII; widely used by ISACs and government CERTs\n- **OpenCTI**: Open-source platform with native MITRE ATT&CK integration and graph-based relationship visualization\n- **Recorded Future**: Commercial feed with AI-powered risk scoring and real-time dark web monitoring\n- **taxii2-client**: Python library for TAXII 2.0\u002F2.1 client operations (pip install taxii2-client)\n- **PyMISP**: Python API for MISP feed management and IOC submission\n\n## Common Pitfalls\n\n- **IOC age staleness**: IP addresses and domains rotate frequently; applying 1-year-old IOCs generates false positives. Enforce TTL policies.\n- **Missing context**: Blocking an IOC without understanding the associated campaign or adversary can disrupt legitimate business traffic (e.g., CDN IPs shared with malicious actors).\n- **Feed overlap without deduplication**: Ingesting the same IOC from five feeds without deduplication inflates indicator counts and SIEM rule complexity.\n- **TLP violation**: Redistributing RED-classified intelligence outside authorized boundaries violates sharing agreements and trust relationships.\n- **Over-blocking on low-confidence indicators**: Indicators with confidence below 50 should trigger detection-only rules, not blocking, to avoid operational disruption.\n",{"name":5,"tags":46,"author":50,"domain":40,"license":15,"version":51,"nist_csf":52,"subdomain":27,"description":57,"mitre_attack":58},[47,37,32,48,38,39,34,49,33],"STIX","IOC","CTI","mahipal","1.0.0",[53,54,55,56],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.\n",[59,60,61,62,63],"T1071.001","T1566","T1568","T1583.001","T1102","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-threat-intelligence-feeds",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-threat-intelligence-feeds",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-threat-intelligence-feeds",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-threat-intelligence-feeds","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002FSKILL.md",true,[88,93,99,103],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"package.json","REFERENCE","参考文档",860,"https:\u002F\u002Fgithub.com\u002Fnodetool-ai\u002Fnodetool\u002Fblob\u002Fmain\u002Fpackages\u002Fsandbox-packs\u002Fsandbox-twilio\u002Fpackage.json",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md",2326,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6967,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-threat-intelligence-feeds\u002Fscripts\u002Fagent.py",[110,137,161,189,214,241],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,122,40,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,133,146,147,122,148,40,125,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,40,176,177,149,178,179,180,181,182,183,184,185,186,187,188],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,40,200,201,202,203,204,205,206,36,207,208,209,210,152,211,212,213],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":221,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[220],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[222,223,224,40,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":248,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[247],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[122,249,40,250,251,29,252,253,254,255,256,184,257,185,258,259,260,261,262,263],"triaging security incident","siem","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]