[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE52Q35B8Q305KJPCB66R2":3,"skill-same:01M6AE52Q35B8Q305KJPCB66R2":164},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":85,"commitSha":86,"skillDirectory":87,"forksCount":88,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":92,"ownerDescription":93,"updatedAt":94,"install":95,"resources":108},"01M6AE52Q35B8Q305KJPCB66R2","configuring-identity-aware-proxy-with-google-iap",null,"Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session\u002Freauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"configuring identity aware proxy with google iap","identity","proxy","google","ZeRO","access-context-manager","identity-aware-proxy","google-iap","zero-trust","service-account","gke","iam","gcp","verification","authentication","run","pr","architecture","cybersecurity","google cloud","2026-11-10 10:12:30",false,"---\nname: configuring-identity-aware-proxy-with-google-iap\ndescription: 'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce\n  per-request identity verification on Compute Engine, App Engine, Cloud Run, and\n  GKE, including IAM bindings, Access Context Manager access levels, session\u002Freauth\n  settings, and service-account programmatic access. Use when replacing VPN access\n  with identity-based access to GCP backends or configuring context-aware, zero-trust\n  policies for Google Cloud services.\n\n  '\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- google-iap\n- identity-aware-proxy\n- gcp\n- zero-trust\n- access-context-manager\n- cloud-run\n- app-engine\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078.004\n- T1133\n- T1021.007\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  techniques:\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1004\n    name: Access with Stolen Session Cookie\n    tactic: initial-access\n    source: f3\n  - id: T1550.001\n    name: 'Use Alternate Authentication Material: Application Access Token'\n    tactic: initial-access\n    source: attack\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n---\n\n# Configuring Identity-Aware Proxy with Google IAP\n\n## When to Use\n\n- When protecting Google Cloud applications (App Engine, Cloud Run, GKE, Compute Engine) with identity-based access\n- When implementing context-aware access requiring device posture and location verification\n- When providing secure access to internal tools without VPN or public IP exposure\n- When needing per-request authentication and authorization for web applications and TCP services\n- When configuring programmatic access to IAP-protected resources using service accounts\n\n**Do not use** for non-HTTP applications that cannot be placed behind an HTTPS load balancer, for public-facing applications that need unauthenticated access, or when applications handle their own authentication and IAP would conflict with existing auth flows.\n\n## Prerequisites\n\n- Google Cloud project with billing enabled\n- IAP API enabled (`gcloud services enable iap.googleapis.com`)\n- Application deployed behind HTTPS Load Balancer, App Engine, or Cloud Run\n- Cloud Identity or Google Workspace for user management\n- Access Context Manager API enabled for access levels\n- OAuth consent screen configured for the project\n\n## Workflow\n\n### Step 1: Enable IAP on Backend Services\n\nConfigure IAP for different GCP compute platforms.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\n\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Internal Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client\ngcloud iap oauth-clients create \\\n  projects\u002FPROJECT_ID\u002Fbrands\u002FBRAND_ID \\\n  --display_name=\"IAP Web Client\"\n\n# === Enable IAP on Compute Engine Backend Service ===\ngcloud compute backend-services update my-backend-service \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# === Enable IAP on App Engine ===\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# === Enable IAP on Cloud Run ===\n# First grant IAP service account the Cloud Run Invoker role\ngcloud run services add-iam-policy-binding my-service \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n\n# Enable IAP on the Cloud Run backend service\ngcloud compute backend-services update my-cloud-run-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# === Enable IAP TCP Forwarding for SSH\u002FRDP ===\n# No load balancer needed - uses IAP tunnel\ngcloud compute instances add-iam-policy-binding my-vm \\\n  --member=\"group:developers@company.com\" \\\n  --role=\"roles\u002Fiap.tunnelResourceAccessor\" \\\n  --zone=us-central1-a\n\n# SSH through IAP tunnel\ngcloud compute ssh my-vm --zone=us-central1-a --tunnel-through-iap\n\n# RDP through IAP tunnel\ngcloud compute start-iap-tunnel my-windows-vm 3389 \\\n  --local-host-port=localhost:3390 \\\n  --zone=us-central1-a\n```\n\n### Step 2: Configure IAM Bindings for Access Control\n\nGrant access to specific users and groups with optional access level conditions.\n\n```bash\n# Grant basic access to a group\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=my-backend-service \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\"\n\n# Grant access with access level condition\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=finance-app \\\n  --member=\"group:finance@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.auth.access_levels.exists(x, x == \"accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-device\"),title=RequireCorporateDevice,description=Requires managed corporate device'\n\n# Grant access only during business hours\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=admin-console \\\n  --member=\"group:admins@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.time.getHours(\"America\u002FNew_York\") >= 8 && request.time.getHours(\"America\u002FNew_York\") \u003C= 18 && request.time.getDayOfWeek(\"America\u002FNew_York\") >= 1 && request.time.getDayOfWeek(\"America\u002FNew_York\") \u003C= 5,title=BusinessHoursOnly'\n\n# Grant access to a specific URL path\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-api \\\n  --member=\"group:api-consumers@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.path.startsWith(\"\u002Fapi\u002Fv2\u002F\"),title=APIv2Access'\n```\n\n### Step 3: Create Access Levels with Access Context Manager\n\nDefine context-based access requirements using device attributes and network conditions.\n\n```bash\n# Create access level requiring encrypted corporate device\ncat > managed-device.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"14.0\"\n      - osType: DESKTOP_CHROME_OS\n    requireScreenlock: true\n    requireAdminApproval: true\n    allowedDeviceManagementLevels:\n      - ADVANCED\nEOF\n\ngcloud access-context-manager levels create managed-device \\\n  --policy=POLICY_ID \\\n  --title=\"Managed Device\" \\\n  --basic-level-spec=managed-device.yaml\n\n# Create access level for corporate network\ncat > corp-network.yaml \u003C\u003C 'EOF'\n- ipSubnetworks:\n    - \"203.0.113.0\u002F24\"\n    - \"198.51.100.0\u002F24\"\n  regions:\n    - US\n    - GB\nEOF\n\ngcloud access-context-manager levels create corp-network \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Network\" \\\n  --basic-level-spec=corp-network.yaml\n\n# Create custom access level using CEL for complex logic\ncat > high-trust.yaml \u003C\u003C 'EOF'\nexpression: >\n  device.encryption_status == DeviceEncryptionStatus.ENCRYPTED &&\n  device.is_admin_approved_device == true &&\n  (\n    origin.ip in [\"203.0.113.0\u002F24\"] ||\n    device.os_type == OsType.DESKTOP_CHROME_OS\n  ) &&\n  request.auth.claims.hd == \"company.com\"\nEOF\n\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust\" \\\n  --custom-level-spec=high-trust.yaml\n```\n\n### Step 4: Configure Session Settings and Re-authentication\n\nSet session duration and re-authentication policies per application.\n\n```bash\n# Configure re-authentication for a backend service\n# Requires login every 4 hours for sensitive apps\ngcloud iap settings set \\\n  --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=finance-app \\\n  reauthSettings.method=LOGIN \\\n  reauthSettings.maxAge=14400s \\\n  reauthSettings.policyType=MINIMUM\n\n# Configure session settings for App Engine\ngcloud iap settings set \\\n  --project=PROJECT_ID \\\n  --resource-type=app-engine \\\n  reauthSettings.method=SECURE_KEY \\\n  reauthSettings.maxAge=3600s \\\n  reauthSettings.policyType=MINIMUM\n\n# View current IAP settings\ngcloud iap settings get \\\n  --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=finance-app\n```\n\n### Step 5: Configure Programmatic Access for Service Accounts\n\nEnable service-to-service communication through IAP-protected endpoints.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Access IAP-protected resource using service account credentials.\"\"\"\n\nimport google.auth\nimport google.auth.transport.requests\nfrom google.auth import impersonated_credentials\nimport requests as req\n\nIAP_CLIENT_ID = \"YOUR_IAP_OAUTH_CLIENT_ID.apps.googleusercontent.com\"\nIAP_URL = \"https:\u002F\u002Fmy-app.company.com\u002Fapi\u002Fdata\"\n\ndef access_iap_resource():\n    # Get default credentials (works with service account key or workload identity)\n    credentials, project = google.auth.default()\n\n    # Create IAP-authenticated request\n    authed_session = google.auth.transport.requests.AuthorizedSession(\n        credentials,\n        target_audience=IAP_CLIENT_ID\n    )\n\n    # Make request to IAP-protected resource\n    response = authed_session.get(IAP_URL)\n    print(f\"Status: {response.status_code}\")\n    print(f\"Response: {response.text[:500]}\")\n\n    return response\n\nif __name__ == \"__main__\":\n    access_iap_resource()\n```\n\n### Step 6: Set Up Audit Logging and Monitoring\n\nConfigure logging for all IAP access decisions.\n\n```bash\n# Enable data access audit logs for IAP\ngcloud projects get-iam-policy PROJECT_ID --format=json > policy.json\n\n# Add IAP audit config to policy.json:\n# {\n#   \"service\": \"iap.googleapis.com\",\n#   \"auditLogConfigs\": [\n#     {\"logType\": \"ADMIN_READ\"},\n#     {\"logType\": \"DATA_READ\"},\n#     {\"logType\": \"DATA_WRITE\"}\n#   ]\n# }\n\ngcloud projects set-iam-policy PROJECT_ID policy.json\n\n# Create log-based metric for denied access\ngcloud logging metrics create iap-denied-access \\\n  --description=\"Count of IAP access denials\" \\\n  --log-filter='resource.type=\"gce_backend_service\" AND protoPayload.status.code=16'\n\n# Create alerting policy for high denial rates\ngcloud alpha monitoring policies create \\\n  --display-name=\"IAP High Denial Rate\" \\\n  --condition-display-name=\"Denied access > 50 in 5 min\" \\\n  --condition-filter='metric.type=\"logging.googleapis.com\u002Fuser\u002Fiap-denied-access\"' \\\n  --condition-threshold-value=50 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n\n# Query IAP access logs\ngcloud logging read '\n  resource.type=\"gce_backend_service\"\n  protoPayload.serviceName=\"iap.googleapis.com\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.status.code,resource.labels.backend_service_name)' --limit=50\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Identity-Aware Proxy | GCP service that intercepts web requests and TCP connections, authenticating users and evaluating access policies before proxying to backend services |\n| Backend Service | GCP load balancer component that IAP protects; can serve Compute Engine instances, GKE pods, Cloud Run services, or App Engine |\n| IAP Tunnel | Secure TCP tunnel through IAP allowing SSH, RDP, and other TCP access to VMs without public IPs or VPN |\n| OAuth Consent Screen | GCP configuration specifying the application name and support email shown to users during IAP authentication |\n| Access Level | Named condition in Access Context Manager evaluated during IAP authorization (device posture, IP, geography) |\n| Re-authentication | IAP feature requiring users to prove their identity again after a configurable session duration |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy for GCP applications and TCP services\n- **Access Context Manager**: Defines access levels based on device, network, and geographic attributes\n- **gcloud CLI**: Command-line tool for configuring IAP, access levels, and IAM bindings\n- **IAP TCP Forwarding**: Tunnel-based access to VMs for SSH\u002FRDP without public IPs\n- **Cloud Audit Logs**: Immutable records of all IAP access decisions for compliance\n- **Endpoint Verification**: Chrome extension collecting device attributes for access level evaluation\n\n## Common Scenarios\n\n### Scenario: Securing 15 Internal GCP Services with IAP\n\n**Context**: An e-commerce company runs 15 internal services on GKE and Cloud Run (admin dashboards, internal APIs, monitoring tools). Currently, these services are protected only by VPN and firewall rules, creating excessive network-level access.\n\n**Approach**:\n1. Deploy all services behind an HTTPS Load Balancer with managed SSL certificates\n2. Enable IAP on each backend service with per-service OAuth clients\n3. Create IAM bindings mapping Google Groups to specific services (admin group -> admin dashboard, engineering -> monitoring)\n4. Define access levels: managed-device (encryption + screen lock), corp-network (office IP ranges)\n5. Apply managed-device access level to admin dashboard and financial tools\n6. Configure IAP TCP tunneling for SSH access to GKE nodes (replacing SSH bastion host)\n7. Set re-authentication to 4 hours for admin tools, 8 hours for monitoring\n8. Configure Cloud Audit Logs and create alerting for repeated denials\n\n**Pitfalls**: IAP adds 10-50ms latency per request; test application performance. WebSocket connections through IAP require specific backend service configuration. Service-to-service calls within GKE should bypass IAP using internal service mesh, not external IAP endpoints. Break-glass access should use a separate IAM binding without access level conditions.\n\n## Output Format\n\n```\nGoogle Cloud IAP Configuration Report\n==================================================\nProject: ecommerce-internal\nReport Date: 2026-02-23\n\nIAP-PROTECTED SERVICES:\n  Backend Services:     12\n  App Engine:            1\n  Cloud Run:             2\n  IAP TCP Tunnels:       4 (SSH access)\n  Total:                19\n\nACCESS CONTROL:\n  IAM Bindings:         34\n  With Access Levels:   18 (52.9%)\n  Access Levels:         3 (managed-device, corp-network, high-trust)\n\nSESSION POLICIES:\n  Admin tools:          4h re-auth (SECURE_KEY)\n  Sensitive apps:       4h re-auth (LOGIN)\n  General tools:        8h re-auth (LOGIN)\n\nACCESS LOGS (last 24h):\n  Total requests:       23,456\n  Authenticated:        23,289 (99.3%)\n  Denied by IAM:           112\n  Denied by access level:   55\n  Unique users:            134\n```\n","# Configuring Identity-Aware Proxy with Google IAP\n\n## When to Use\n\n- When protecting Google Cloud applications (App Engine, Cloud Run, GKE, Compute Engine) with identity-based access\n- When implementing context-aware access requiring device posture and location verification\n- When providing secure access to internal tools without VPN or public IP exposure\n- When needing per-request authentication and authorization for web applications and TCP services\n- When configuring programmatic access to IAP-protected resources using service accounts\n\n**Do not use** for non-HTTP applications that cannot be placed behind an HTTPS load balancer, for public-facing applications that need unauthenticated access, or when applications handle their own authentication and IAP would conflict with existing auth flows.\n\n## Prerequisites\n\n- Google Cloud project with billing enabled\n- IAP API enabled (`gcloud services enable iap.googleapis.com`)\n- Application deployed behind HTTPS Load Balancer, App Engine, or Cloud Run\n- Cloud Identity or Google Workspace for user management\n- Access Context Manager API enabled for access levels\n- OAuth consent screen configured for the project\n\n## Workflow\n\n### Step 1: Enable IAP on Backend Services\n\nConfigure IAP for different GCP compute platforms.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\n\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Internal Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client\ngcloud iap oauth-clients create \\\n  projects\u002FPROJECT_ID\u002Fbrands\u002FBRAND_ID \\\n  --display_name=\"IAP Web Client\"\n\n# === Enable IAP on Compute Engine Backend Service ===\ngcloud compute backend-services update my-backend-service \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# === Enable IAP on App Engine ===\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# === Enable IAP on Cloud Run ===\n# First grant IAP service account the Cloud Run Invoker role\ngcloud run services add-iam-policy-binding my-service \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n\n# Enable IAP on the Cloud Run backend service\ngcloud compute backend-services update my-cloud-run-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# === Enable IAP TCP Forwarding for SSH\u002FRDP ===\n# No load balancer needed - uses IAP tunnel\ngcloud compute instances add-iam-policy-binding my-vm \\\n  --member=\"group:developers@company.com\" \\\n  --role=\"roles\u002Fiap.tunnelResourceAccessor\" \\\n  --zone=us-central1-a\n\n# SSH through IAP tunnel\ngcloud compute ssh my-vm --zone=us-central1-a --tunnel-through-iap\n\n# RDP through IAP tunnel\ngcloud compute start-iap-tunnel my-windows-vm 3389 \\\n  --local-host-port=localhost:3390 \\\n  --zone=us-central1-a\n```\n\n### Step 2: Configure IAM Bindings for Access Control\n\nGrant access to specific users and groups with optional access level conditions.\n\n```bash\n# Grant basic access to a group\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=my-backend-service \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\"\n\n# Grant access with access level condition\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=finance-app \\\n  --member=\"group:finance@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.auth.access_levels.exists(x, x == \"accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-device\"),title=RequireCorporateDevice,description=Requires managed corporate device'\n\n# Grant access only during business hours\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=admin-console \\\n  --member=\"group:admins@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.time.getHours(\"America\u002FNew_York\") >= 8 && request.time.getHours(\"America\u002FNew_York\") \u003C= 18 && request.time.getDayOfWeek(\"America\u002FNew_York\") >= 1 && request.time.getDayOfWeek(\"America\u002FNew_York\") \u003C= 5,title=BusinessHoursOnly'\n\n# Grant access to a specific URL path\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-api \\\n  --member=\"group:api-consumers@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition='expression=request.path.startsWith(\"\u002Fapi\u002Fv2\u002F\"),title=APIv2Access'\n```\n\n### Step 3: Create Access Levels with Access Context Manager\n\nDefine context-based access requirements using device attributes and network conditions.\n\n```bash\n# Create access level requiring encrypted corporate device\ncat > managed-device.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"14.0\"\n      - osType: DESKTOP_CHROME_OS\n    requireScreenlock: true\n    requireAdminApproval: true\n    allowedDeviceManagementLevels:\n      - ADVANCED\nEOF\n\ngcloud access-context-manager levels create managed-device \\\n  --policy=POLICY_ID \\\n  --title=\"Managed Device\" \\\n  --basic-level-spec=managed-device.yaml\n\n# Create access level for corporate network\ncat > corp-network.yaml \u003C\u003C 'EOF'\n- ipSubnetworks:\n    - \"203.0.113.0\u002F24\"\n    - \"198.51.100.0\u002F24\"\n  regions:\n    - US\n    - GB\nEOF\n\ngcloud access-context-manager levels create corp-network \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Network\" \\\n  --basic-level-spec=corp-network.yaml\n\n# Create custom access level using CEL for complex logic\ncat > high-trust.yaml \u003C\u003C 'EOF'\nexpression: >\n  device.encryption_status == DeviceEncryptionStatus.ENCRYPTED &&\n  device.is_admin_approved_device == true &&\n  (\n    origin.ip in [\"203.0.113.0\u002F24\"] ||\n    device.os_type == OsType.DESKTOP_CHROME_OS\n  ) &&\n  request.auth.claims.hd == \"company.com\"\nEOF\n\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust\" \\\n  --custom-level-spec=high-trust.yaml\n```\n\n### Step 4: Configure Session Settings and Re-authentication\n\nSet session duration and re-authentication policies per application.\n\n```bash\n# Configure re-authentication for a backend service\n# Requires login every 4 hours for sensitive apps\ngcloud iap settings set \\\n  --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=finance-app \\\n  reauthSettings.method=LOGIN \\\n  reauthSettings.maxAge=14400s \\\n  reauthSettings.policyType=MINIMUM\n\n# Configure session settings for App Engine\ngcloud iap settings set \\\n  --project=PROJECT_ID \\\n  --resource-type=app-engine \\\n  reauthSettings.method=SECURE_KEY \\\n  reauthSettings.maxAge=3600s \\\n  reauthSettings.policyType=MINIMUM\n\n# View current IAP settings\ngcloud iap settings get \\\n  --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=finance-app\n```\n\n### Step 5: Configure Programmatic Access for Service Accounts\n\nEnable service-to-service communication through IAP-protected endpoints.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Access IAP-protected resource using service account credentials.\"\"\"\n\nimport google.auth\nimport google.auth.transport.requests\nfrom google.auth import impersonated_credentials\nimport requests as req\n\nIAP_CLIENT_ID = \"YOUR_IAP_OAUTH_CLIENT_ID.apps.googleusercontent.com\"\nIAP_URL = \"https:\u002F\u002Fmy-app.company.com\u002Fapi\u002Fdata\"\n\ndef access_iap_resource():\n    # Get default credentials (works with service account key or workload identity)\n    credentials, project = google.auth.default()\n\n    # Create IAP-authenticated request\n    authed_session = google.auth.transport.requests.AuthorizedSession(\n        credentials,\n        target_audience=IAP_CLIENT_ID\n    )\n\n    # Make request to IAP-protected resource\n    response = authed_session.get(IAP_URL)\n    print(f\"Status: {response.status_code}\")\n    print(f\"Response: {response.text[:500]}\")\n\n    return response\n\nif __name__ == \"__main__\":\n    access_iap_resource()\n```\n\n### Step 6: Set Up Audit Logging and Monitoring\n\nConfigure logging for all IAP access decisions.\n\n```bash\n# Enable data access audit logs for IAP\ngcloud projects get-iam-policy PROJECT_ID --format=json > policy.json\n\n# Add IAP audit config to policy.json:\n# {\n#   \"service\": \"iap.googleapis.com\",\n#   \"auditLogConfigs\": [\n#     {\"logType\": \"ADMIN_READ\"},\n#     {\"logType\": \"DATA_READ\"},\n#     {\"logType\": \"DATA_WRITE\"}\n#   ]\n# }\n\ngcloud projects set-iam-policy PROJECT_ID policy.json\n\n# Create log-based metric for denied access\ngcloud logging metrics create iap-denied-access \\\n  --description=\"Count of IAP access denials\" \\\n  --log-filter='resource.type=\"gce_backend_service\" AND protoPayload.status.code=16'\n\n# Create alerting policy for high denial rates\ngcloud alpha monitoring policies create \\\n  --display-name=\"IAP High Denial Rate\" \\\n  --condition-display-name=\"Denied access > 50 in 5 min\" \\\n  --condition-filter='metric.type=\"logging.googleapis.com\u002Fuser\u002Fiap-denied-access\"' \\\n  --condition-threshold-value=50 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n\n# Query IAP access logs\ngcloud logging read '\n  resource.type=\"gce_backend_service\"\n  protoPayload.serviceName=\"iap.googleapis.com\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.status.code,resource.labels.backend_service_name)' --limit=50\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Identity-Aware Proxy | GCP service that intercepts web requests and TCP connections, authenticating users and evaluating access policies before proxying to backend services |\n| Backend Service | GCP load balancer component that IAP protects; can serve Compute Engine instances, GKE pods, Cloud Run services, or App Engine |\n| IAP Tunnel | Secure TCP tunnel through IAP allowing SSH, RDP, and other TCP access to VMs without public IPs or VPN |\n| OAuth Consent Screen | GCP configuration specifying the application name and support email shown to users during IAP authentication |\n| Access Level | Named condition in Access Context Manager evaluated during IAP authorization (device posture, IP, geography) |\n| Re-authentication | IAP feature requiring users to prove their identity again after a configurable session duration |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy for GCP applications and TCP services\n- **Access Context Manager**: Defines access levels based on device, network, and geographic attributes\n- **gcloud CLI**: Command-line tool for configuring IAP, access levels, and IAM bindings\n- **IAP TCP Forwarding**: Tunnel-based access to VMs for SSH\u002FRDP without public IPs\n- **Cloud Audit Logs**: Immutable records of all IAP access decisions for compliance\n- **Endpoint Verification**: Chrome extension collecting device attributes for access level evaluation\n\n## Common Scenarios\n\n### Scenario: Securing 15 Internal GCP Services with IAP\n\n**Context**: An e-commerce company runs 15 internal services on GKE and Cloud Run (admin dashboards, internal APIs, monitoring tools). Currently, these services are protected only by VPN and firewall rules, creating excessive network-level access.\n\n**Approach**:\n1. Deploy all services behind an HTTPS Load Balancer with managed SSL certificates\n2. Enable IAP on each backend service with per-service OAuth clients\n3. Create IAM bindings mapping Google Groups to specific services (admin group -> admin dashboard, engineering -> monitoring)\n4. Define access levels: managed-device (encryption + screen lock), corp-network (office IP ranges)\n5. Apply managed-device access level to admin dashboard and financial tools\n6. Configure IAP TCP tunneling for SSH access to GKE nodes (replacing SSH bastion host)\n7. Set re-authentication to 4 hours for admin tools, 8 hours for monitoring\n8. Configure Cloud Audit Logs and create alerting for repeated denials\n\n**Pitfalls**: IAP adds 10-50ms latency per request; test application performance. WebSocket connections through IAP require specific backend service configuration. Service-to-service calls within GKE should bypass IAP using internal service mesh, not external IAP endpoints. Break-glass access should use a separate IAM binding without access level conditions.\n\n## Output Format\n\n```\nGoogle Cloud IAP Configuration Report\n==================================================\nProject: ecommerce-internal\nReport Date: 2026-02-23\n\nIAP-PROTECTED SERVICES:\n  Backend Services:     12\n  App Engine:            1\n  Cloud Run:             2\n  IAP TCP Tunnels:       4 (SSH access)\n  Total:                19\n\nACCESS CONTROL:\n  IAM Bindings:         34\n  With Access Levels:   18 (52.9%)\n  Access Levels:         3 (managed-device, corp-network, high-trust)\n\nSESSION POLICIES:\n  Admin tools:          4h re-auth (SECURE_KEY)\n  Sensitive apps:       4h re-auth (LOGIN)\n  General tools:        8h re-auth (LOGIN)\n\nACCESS LOGS (last 24h):\n  Total requests:       23,456\n  Authenticated:        23,289 (99.3%)\n  Denied by IAM:           112\n  Denied by access level:   55\n  Unique users:            134\n```\n",{"name":5,"tags":49,"author":52,"domain":42,"license":15,"version":53,"mitre_f3":54,"nist_csf":74,"subdomain":79,"description":80,"mitre_attack":81},[31,30,36,32,29,50,51],"cloud-run","app-engine","mahipal","1.0",{"tactics":55,"version":58,"techniques":59},[56,57],"initial-access","positioning","1.1",[60,64,67,71],{"id":61,"name":62,"source":63,"tactic":56},"F1006","Account Takeover","f3",{"id":65,"name":66,"source":63,"tactic":56},"F1004","Access with Stolen Session Cookie",{"id":68,"name":69,"source":70,"tactic":56},"T1550.001","Use Alternate Authentication Material: Application Access Token","attack",{"id":72,"name":73,"source":70,"tactic":57},"T1539","Steal Web Session Cookie",[75,76,77,78],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session\u002Freauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services.\n",[82,83,84],"T1078.004","T1133","T1021.007","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-identity-aware-proxy-with-google-iap",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":96,"prompt":106,"zipAvailable":107},[97,100,103],{"tool":98,"command":99},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-identity-aware-proxy-with-google-iap",{"tool":101,"command":102},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-identity-aware-proxy-with-google-iap",{"tool":104,"command":105},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-identity-aware-proxy-with-google-iap","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002FSKILL.md",true,[109,115,121,125,129,134,138,142,146,150,154,160],{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"agents\u002Fopenai.yaml","REFERENCE","参考文档",139,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fteach\u002Fagents\u002Fopenai.yaml",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"assets\u002Ftemplate.md","ASSET","资产文件",2266,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Fassets\u002Ftemplate.md",{"path":122,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":123,"sourceHtmlUrl":124},"GLOSSARY-FORMAT.md",2122,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fteach\u002FGLOSSARY-FORMAT.md",{"path":126,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":127,"sourceHtmlUrl":128},"LEARNING-RECORD-FORMAT.md",2747,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fteach\u002FLEARNING-RECORD-FORMAT.md",{"path":130,"resourceType":130,"resourceTypeDesc":131,"sizeBytes":132,"sourceHtmlUrl":133},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002FLICENSE",{"path":135,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":136,"sourceHtmlUrl":137},"MISSION-FORMAT.md",1540,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fteach\u002FMISSION-FORMAT.md",{"path":139,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":140,"sourceHtmlUrl":141},"references\u002Fapi-reference.md",1597,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Freferences\u002Fapi-reference.md",{"path":143,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":144,"sourceHtmlUrl":145},"references\u002Fstandards.md",1762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Freferences\u002Fstandards.md",{"path":147,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":148,"sourceHtmlUrl":149},"references\u002Fworkflows.md",2490,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Freferences\u002Fworkflows.md",{"path":151,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":152,"sourceHtmlUrl":153},"RESOURCES-FORMAT.md",1924,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fteach\u002FRESOURCES-FORMAT.md",{"path":155,"resourceType":156,"resourceTypeDesc":157,"sizeBytes":158,"sourceHtmlUrl":159},"scripts\u002Fagent.py","SCRIPT","脚本",4547,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Fscripts\u002Fagent.py",{"path":161,"resourceType":156,"resourceTypeDesc":157,"sizeBytes":162,"sourceHtmlUrl":163},"scripts\u002Fprocess.py",7875,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-identity-aware-proxy-with-google-iap\u002Fscripts\u002Fprocess.py",[165,190,212,240,266,293],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,174,175,176,177,42,178,25,40,179,180,181,182,183,184,185,186,187,188,189],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,186,199,200,177,201,42,40,37,28,202,203,204,205,206,207,208,209,210,211],"boot","TPM","validating tpm measured boot attestation","policy","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":222,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[218,221],{"categoryNo":219,"categoryName":220,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[206,223,224,225,226,42,227,228,37,229,230,231,232,233,234,235,236,237,238,239],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[248,249,250,42,251,252,253,254,255,256,257,258,259,260,261,262,203,263,264,265],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":267,"name":268,"nameZh":6,"description":269,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":270,"categories":271,"keywords":273,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[272],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[274,275,276,42,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":294,"name":295,"nameZh":6,"description":296,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":297,"categories":298,"keywords":300,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[299],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,301,42,302,303,304,305,306,307,308,309,235,310,236,311,312,313,314,315,316],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]