[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE59C04GZXVZ2C7NFYKSBR":3,"skill-same:01M6AE59C04GZXVZ2C7NFYKSBR":118},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AE59C04GZXVZ2C7NFYKSBR","configuring-microsegmentation-for-zero-trust",null,"Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures. Use when designing or implementing network microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"ZeRO","configuring microsegmentation for zero trust","security","cybersecurity","architecture","workload","pr","network","network-security","least-privilege","NIST","lateral-movement","zero-trust","microsegmentation","network-access","2026-11-10 10:12:30",false,"---\nname: configuring-microsegmentation-for-zero-trust\ndescription: Configures microsegmentation policies to enforce least-privilege workload-to-workload\n  access using tools such as VMware NSX, Illumio, and Calico, preventing lateral\n  movement in zero trust architectures. Use when designing or implementing network\n  microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- microsegmentation\n- network-access\n- lateral-movement\n- network-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1021\n- T1210\n- T1570\n- T1046\n- T1018\n---\n\n# Configuring Microsegmentation for Zero Trust\n\n## Prerequisites\n\n- Understanding of zero trust principles (NIST SP 800-207)\n- Knowledge of network segmentation concepts\n- Familiarity with firewall and SDN technologies\n- Experience with VMware NSX, Illumio, Guardicore, or Cisco ACI\n\n## Overview\n\nMicrosegmentation divides a network into granular security zones, enforcing least-privilege access between workloads at the application layer rather than relying on traditional VLAN-based segmentation. In a zero trust architecture, microsegmentation eliminates implicit trust between workloads within the same network segment, preventing lateral movement even after an attacker gains initial access.\n\nThis skill covers designing microsegmentation policies using workload identity, implementing host-based and network-based enforcement, and validating segmentation effectiveness with tools like Illumio Core and VMware NSX.\n\n\n## When to Use\n\n- When deploying or configuring configuring microsegmentation for zero trust capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with zero trust architecture concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Microsegmentation Models\n\n1. **Network-Based (VMware NSX, Cisco ACI)**: Distributed firewall rules enforced at the hypervisor or network fabric level\n2. **Host-Based (Illumio, Guardicore)**: Agent-based enforcement at the OS level using iptables\u002FWFP rules\n3. **Container-Based (Calico, Cilium)**: Network policies enforced at the pod\u002Fcontainer level in Kubernetes\n4. **Application-Based (Zscaler Workload Segmentation)**: Identity-based segmentation based on software identity rather than IP addresses\n\n### Enforcement Points\n\n```\nTraditional Segmentation        Microsegmentation\n┌─────────────────┐            ┌──────────────────────┐\n│  VLAN 10        │            │  Workload A ←policy→ │\n│  ┌───┐ ┌───┐   │            │  Workload B ←policy→ │\n│  │ A │ │ B │   │            │  Workload C ←policy→ │\n│  └───┘ └───┘   │            │  Workload D ←policy→ │\n│  (trust each    │            │  (zero trust between  │\n│   other)        │            │   every pair)         │\n└─────────────────┘            └──────────────────────┘\n```\n\n## Key Concepts\n\n### Application Dependency Mapping\nBefore creating segmentation policies, discover actual communication flows between workloads using traffic telemetry. Tools like Illumio, Guardicore, and AppDynamics provide application dependency maps showing which workloads communicate, over which ports, and how frequently.\n\n### Policy Modeling\nDraft policies in monitor\u002Fvisibility mode before enforcement. This allows validation that proposed rules will not break legitimate traffic while identifying unnecessary or risky communication paths.\n\n### Label-Based Policy\nModern microsegmentation uses labels (role, application, environment, location) instead of IP-based rules. Label-based policies are portable across environments and survive IP changes during migrations.\n\n### Ring-Fencing\nIsolate critical applications (PCI cardholder data environment, SWIFT financial systems, healthcare PHI) with strict allow-list policies that deny all traffic not explicitly permitted.\n\n## Workflow\n\n### Phase 1: Discovery and Mapping\n\n1. **Deploy Visibility Agents**\n   - Install lightweight agents on all workloads (servers, VMs, containers)\n   - Configure agents to report real-time traffic telemetry to the management console\n   - Allow 2-4 weeks of traffic collection to build a comprehensive flow map\n\n2. **Build Application Dependency Map**\n   - Review auto-discovered communication flows in the management console\n   - Identify application tiers: web servers, app servers, databases, middleware\n   - Map legitimate communication paths and flag unexpected connections\n   - Document data flows for compliance scope (PCI, HIPAA)\n\n3. **Assign Labels**\n   - Create a labeling taxonomy: Role (web, app, db), Application (ERP, CRM), Environment (prod, dev, staging), Location (dc1, aws-east)\n   - Apply labels to all workloads via the management console or API\n   - Validate label accuracy against CMDB and application owner input\n\n### Phase 2: Policy Design\n\n4. **Define Segmentation Zones**\n   - Environment isolation: Production cannot communicate with Development\n   - Tier isolation: Database tier only accepts connections from application tier\n   - Application ring-fencing: PCI applications isolated from non-PCI workloads\n   - Administrative access: Jump servers are the only management path\n\n5. **Create Allow-List Policies**\n   - For each application, define explicit allow rules for required communication\n   - Use label-based rules rather than IP-based where possible\n   - Include process-level restrictions where supported (e.g., only httpd on port 443)\n   - Set default-deny for all unlisted communication\n\n6. **Model Policies in Test Mode**\n   - Enable policies in visibility\u002Ftest mode (do not enforce)\n   - Monitor for would-be blocked legitimate traffic\n   - Refine policies based on test results over 1-2 weeks\n   - Get application owner sign-off before enforcement\n\n### Phase 3: Enforcement\n\n7. **Enforce Incrementally**\n   - Start with the most isolated, lowest-risk application\n   - Switch policy from test mode to enforce mode\n   - Monitor for application issues in the first 24-48 hours\n   - Proceed to next application after validation\n\n8. **Validate Segmentation**\n   - Run penetration tests attempting lateral movement between segments\n   - Verify that blocked traffic generates alerts in the management console\n   - Test emergency override procedures (break-glass)\n   - Document enforcement status for each application zone\n\n### Phase 4: Operational Maintenance\n\n9. **Ongoing Policy Management**\n   - Integrate with CI\u002FCD: auto-label new workloads from deployment pipelines\n   - Review policy violations weekly and investigate anomalies\n   - Update policies when applications change or new services deploy\n   - Perform quarterly segmentation effectiveness reviews\n\n## Validation Checklist\n\n- [ ] Agents deployed on all in-scope workloads\n- [ ] Application dependency map reviewed and approved by app owners\n- [ ] Labels assigned and validated against CMDB\n- [ ] Policies modeled in test mode with no false positives for 2+ weeks\n- [ ] Policies enforced incrementally with monitoring\n- [ ] Default-deny active for all segmented zones\n- [ ] Lateral movement tests confirm blocked unauthorized traffic\n- [ ] Alerting configured for policy violations\n- [ ] Break-glass procedure documented and tested\n- [ ] Compliance auditor sign-off for regulated environments\n\n## References\n\n- NIST SP 800-207: Zero Trust Architecture\n- CISA Zero Trust Maturity Model v2.0 - Network Pillar\n- Illumio Core Administration Guide\n- VMware NSX Distributed Firewall Configuration Guide\n- Forrester Zero Trust eXtended (ZTX) Framework\n","# Configuring Microsegmentation for Zero Trust\n\n## Prerequisites\n\n- Understanding of zero trust principles (NIST SP 800-207)\n- Knowledge of network segmentation concepts\n- Familiarity with firewall and SDN technologies\n- Experience with VMware NSX, Illumio, Guardicore, or Cisco ACI\n\n## Overview\n\nMicrosegmentation divides a network into granular security zones, enforcing least-privilege access between workloads at the application layer rather than relying on traditional VLAN-based segmentation. In a zero trust architecture, microsegmentation eliminates implicit trust between workloads within the same network segment, preventing lateral movement even after an attacker gains initial access.\n\nThis skill covers designing microsegmentation policies using workload identity, implementing host-based and network-based enforcement, and validating segmentation effectiveness with tools like Illumio Core and VMware NSX.\n\n\n## When to Use\n\n- When deploying or configuring configuring microsegmentation for zero trust capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with zero trust architecture concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Microsegmentation Models\n\n1. **Network-Based (VMware NSX, Cisco ACI)**: Distributed firewall rules enforced at the hypervisor or network fabric level\n2. **Host-Based (Illumio, Guardicore)**: Agent-based enforcement at the OS level using iptables\u002FWFP rules\n3. **Container-Based (Calico, Cilium)**: Network policies enforced at the pod\u002Fcontainer level in Kubernetes\n4. **Application-Based (Zscaler Workload Segmentation)**: Identity-based segmentation based on software identity rather than IP addresses\n\n### Enforcement Points\n\n```\nTraditional Segmentation        Microsegmentation\n┌─────────────────┐            ┌──────────────────────┐\n│  VLAN 10        │            │  Workload A ←policy→ │\n│  ┌───┐ ┌───┐   │            │  Workload B ←policy→ │\n│  │ A │ │ B │   │            │  Workload C ←policy→ │\n│  └───┘ └───┘   │            │  Workload D ←policy→ │\n│  (trust each    │            │  (zero trust between  │\n│   other)        │            │   every pair)         │\n└─────────────────┘            └──────────────────────┘\n```\n\n## Key Concepts\n\n### Application Dependency Mapping\nBefore creating segmentation policies, discover actual communication flows between workloads using traffic telemetry. Tools like Illumio, Guardicore, and AppDynamics provide application dependency maps showing which workloads communicate, over which ports, and how frequently.\n\n### Policy Modeling\nDraft policies in monitor\u002Fvisibility mode before enforcement. This allows validation that proposed rules will not break legitimate traffic while identifying unnecessary or risky communication paths.\n\n### Label-Based Policy\nModern microsegmentation uses labels (role, application, environment, location) instead of IP-based rules. Label-based policies are portable across environments and survive IP changes during migrations.\n\n### Ring-Fencing\nIsolate critical applications (PCI cardholder data environment, SWIFT financial systems, healthcare PHI) with strict allow-list policies that deny all traffic not explicitly permitted.\n\n## Workflow\n\n### Phase 1: Discovery and Mapping\n\n1. **Deploy Visibility Agents**\n   - Install lightweight agents on all workloads (servers, VMs, containers)\n   - Configure agents to report real-time traffic telemetry to the management console\n   - Allow 2-4 weeks of traffic collection to build a comprehensive flow map\n\n2. **Build Application Dependency Map**\n   - Review auto-discovered communication flows in the management console\n   - Identify application tiers: web servers, app servers, databases, middleware\n   - Map legitimate communication paths and flag unexpected connections\n   - Document data flows for compliance scope (PCI, HIPAA)\n\n3. **Assign Labels**\n   - Create a labeling taxonomy: Role (web, app, db), Application (ERP, CRM), Environment (prod, dev, staging), Location (dc1, aws-east)\n   - Apply labels to all workloads via the management console or API\n   - Validate label accuracy against CMDB and application owner input\n\n### Phase 2: Policy Design\n\n4. **Define Segmentation Zones**\n   - Environment isolation: Production cannot communicate with Development\n   - Tier isolation: Database tier only accepts connections from application tier\n   - Application ring-fencing: PCI applications isolated from non-PCI workloads\n   - Administrative access: Jump servers are the only management path\n\n5. **Create Allow-List Policies**\n   - For each application, define explicit allow rules for required communication\n   - Use label-based rules rather than IP-based where possible\n   - Include process-level restrictions where supported (e.g., only httpd on port 443)\n   - Set default-deny for all unlisted communication\n\n6. **Model Policies in Test Mode**\n   - Enable policies in visibility\u002Ftest mode (do not enforce)\n   - Monitor for would-be blocked legitimate traffic\n   - Refine policies based on test results over 1-2 weeks\n   - Get application owner sign-off before enforcement\n\n### Phase 3: Enforcement\n\n7. **Enforce Incrementally**\n   - Start with the most isolated, lowest-risk application\n   - Switch policy from test mode to enforce mode\n   - Monitor for application issues in the first 24-48 hours\n   - Proceed to next application after validation\n\n8. **Validate Segmentation**\n   - Run penetration tests attempting lateral movement between segments\n   - Verify that blocked traffic generates alerts in the management console\n   - Test emergency override procedures (break-glass)\n   - Document enforcement status for each application zone\n\n### Phase 4: Operational Maintenance\n\n9. **Ongoing Policy Management**\n   - Integrate with CI\u002FCD: auto-label new workloads from deployment pipelines\n   - Review policy violations weekly and investigate anomalies\n   - Update policies when applications change or new services deploy\n   - Perform quarterly segmentation effectiveness reviews\n\n## Validation Checklist\n\n- [ ] Agents deployed on all in-scope workloads\n- [ ] Application dependency map reviewed and approved by app owners\n- [ ] Labels assigned and validated against CMDB\n- [ ] Policies modeled in test mode with no false positives for 2+ weeks\n- [ ] Policies enforced incrementally with monitoring\n- [ ] Default-deny active for all segmented zones\n- [ ] Lateral movement tests confirm blocked unauthorized traffic\n- [ ] Alerting configured for policy violations\n- [ ] Break-glass procedure documented and tested\n- [ ] Compliance auditor sign-off for regulated environments\n\n## References\n\n- NIST SP 800-207: Zero Trust Architecture\n- CISA Zero Trust Maturity Model v2.0 - Network Pillar\n- Illumio Core Administration Guide\n- VMware NSX Distributed Firewall Configuration Guide\n- Forrester Zero Trust eXtended (ZTX) Framework\n",{"name":5,"tags":44,"author":45,"domain":27,"license":15,"version":46,"nist_csf":47,"subdomain":52,"description":7,"mitre_attack":53},[36,37,38,35,32],"mahipal","1.0",[48,49,50,51],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[54,55,56,57,58],"T1021","T1210","T1570","T1046","T1018","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-microsegmentation-for-zero-trust",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-microsegmentation-for-zero-trust",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-microsegmentation-for-zero-trust",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-microsegmentation-for-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002FSKILL.md",true,[83,89,94,100,104,108,114],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"assets\u002Ftemplate.md","ASSET","资产文件",2422,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Fassets\u002Ftemplate.md",{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",1417,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fstandards.md",3612,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Freferences\u002Fstandards.md",{"path":105,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fworkflows.md",7113,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Freferences\u002Fworkflows.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",5104,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Fscripts\u002Fagent.py",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fprocess.py",12360,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-microsegmentation-for-zero-trust\u002Fscripts\u002Fprocess.py",[119,144,167,195,221,248],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":126,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[125],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,128,129,130,26,27,131,132,30,133,134,135,136,137,138,139,140,141,142,143],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":151,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[150],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,140,153,154,26,155,27,30,156,24,157,158,159,160,161,162,163,164,165,166],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[173,176],{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,178,179,180,181,27,182,183,156,184,185,186,187,188,189,190,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[203,204,205,27,206,207,208,209,210,211,212,213,214,215,216,217,158,218,219,220],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[227],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[229,230,231,27,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[254],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,256,27,257,258,259,260,261,34,262,263,190,264,191,265,266,267,268,269,270],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]