[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE7QWM6G4QRDKXWW5ACVDH":3,"skill-same:01M6AE7QWM6G4QRDKXWW5ACVDH":135},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":79,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M6AE7QWM6G4QRDKXWW5ACVDH","deploying-edr-agent-with-crowdstrike",null,"Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"deploying edr agent with crowdstrike","Enterprise","sensor-deployment","Falcon","CrowdStrike","edr","detection","endpoint","endpoint-security","T1059.001","security","threat-detection","onboarding","deployment","pr","telemetry","siem","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: deploying-edr-agent-with-crowdstrike\ndescription: 'Deploys and configures CrowdStrike Falcon EDR agents across enterprise\n  endpoints to enable real-time threat detection, behavioral analysis, and automated\n  response. Use when onboarding endpoints to EDR coverage, configuring detection policies,\n  or integrating Falcon telemetry with SIEM platforms. Activates for requests involving\n  CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or\n  endpoint detection and response.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- edr\n- CrowdStrike\n- Falcon\n- threat-detection\n- sensor-deployment\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1003.001\n- T1055\n- T1059.001\n- T1486\n- T1071.001\n---\n# Deploying EDR Agent with CrowdStrike\n\n## When to Use\n\nUse this skill when:\n- Deploying CrowdStrike Falcon sensors to Windows, macOS, or Linux endpoints\n- Configuring Falcon prevention and detection policies for different endpoint groups\n- Integrating CrowdStrike telemetry with SIEM (Splunk, Elastic, Sentinel) for correlated detection\n- Troubleshooting sensor connectivity, performance, or detection issues\n\n**Do not use** this skill for deploying other EDR solutions (Carbon Black, SentinelOne) or for Falcon cloud workload protection (use cloud-specific deployment guides).\n\n## Prerequisites\n\n- CrowdStrike Falcon console access with Falcon Administrator role\n- Customer ID (CID) and Falcon sensor installer package\n- Administrative\u002Froot access on target endpoints\n- Network access: endpoints must reach CrowdStrike cloud (ts01-b.cloudsink.net on port 443)\n- Deployment tool: SCCM, Intune, GPO, Ansible, or manual installation\n\n## Workflow\n\n### Step 1: Obtain Falcon Sensor Installer and CID\n\n```\n1. Log into Falcon Console: https:\u002F\u002Ffalcon.crowdstrike.com\n2. Navigate: Host setup and management → Sensor downloads\n3. Download the appropriate installer:\n   - Windows: WindowsSensor_\u003Cversion>.exe\n   - macOS: FalconSensorMacOS_\u003Cversion>.pkg\n   - Linux: falcon-sensor_\u003Cversion>_amd64.deb \u002F .rpm\n4. Copy the Customer ID (CID) from the Sensor downloads page\n   - CID format: \u003C32-char-hex>-\u003C2-char-checksum>\n```\n\n### Step 2: Deploy Falcon Sensor - Windows\n\n**Silent installation via command line**:\n```cmd\nWindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CYOUR_CID>\n```\n\n**SCCM deployment**:\n```\n1. Create an Application in SCCM\n2. Deployment type: Script Installer\n3. Install command: WindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\n4. Detection method: Registry key exists\n   - HKLM\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default\n5. Deploy to target collection\n6. Deployment purpose: Required (for mandatory installation)\n```\n\n**Microsoft Intune deployment**:\n```\n1. Navigate: Devices → Windows → Configuration profiles\n2. Create Win32 app deployment\n3. Upload .intunewin package (wrapped sensor installer)\n4. Install command: WindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\n5. Detection rule: File exists C:\\Windows\\System32\\drivers\\CrowdStrike\\csagent.sys\n6. Assign to device group\n```\n\n**GPO deployment**:\n```powershell\n# Create startup script that checks for existing installation\n$sensorPath = \"C:\\Windows\\System32\\drivers\\CrowdStrike\\csagent.sys\"\nif (-not (Test-Path $sensorPath)) {\n    Start-Process -FilePath \"\\\\fileserver\\CrowdStrike\\WindowsSensor.exe\" `\n      -ArgumentList \"\u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\" -Wait\n}\n```\n\n### Step 3: Deploy Falcon Sensor - Linux\n\n```bash\n# Debian\u002FUbuntu\nsudo dpkg -i falcon-sensor_7.18.0-17106_amd64.deb\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -s -f --cid=\u003CYOUR_CID>\nsudo systemctl start falcon-sensor\nsudo systemctl enable falcon-sensor\n\n# RHEL\u002FCentOS\nsudo yum install falcon-sensor-7.18.0-17106.el8.x86_64.rpm\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -s -f --cid=\u003CYOUR_CID>\nsudo systemctl start falcon-sensor\nsudo systemctl enable falcon-sensor\n\n# Verify sensor is running and connected\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -g --rfm-state\n# Expected output: rfm-state=false (sensor is communicating with cloud)\n```\n\n### Step 4: Deploy Falcon Sensor - macOS\n\n```bash\n# Install sensor package\nsudo installer -pkg FalconSensorMacOS_7.18.pkg -target \u002F\n\n# Set CID\nsudo \u002FApplications\u002FFalcon.app\u002FContents\u002FResources\u002Ffalconctl license \u003CYOUR_CID>\n\n# Grant Full Disk Access and System Extension via MDM profile\n# Required for macOS Ventura+ (manual approval or MDM PPPC profile)\n# MDM payload: com.crowdstrike.falcon.Agent → SystemExtension + Full Disk Access\n\n# Verify sensor status\nsudo \u002FApplications\u002FFalcon.app\u002FContents\u002FResources\u002Ffalconctl stats\n```\n\n### Step 5: Configure Prevention Policies\n\nIn Falcon Console, navigate to Configuration → Prevention Policies:\n\n**Recommended prevention policy settings**:\n```\nMachine Learning:\n  - Cloud ML: Aggressive (extra protection, may increase false positives)\n  - Sensor ML: Moderate\n  - Adware & PUP: Moderate\n\nBehavioral Protection:\n  - On Write: Enabled (detect malware on file creation)\n  - On Sensor ML: Enabled\n  - Interpreter-Only: Enabled (detect script-based attacks)\n\nExploit Mitigation:\n  - Exploit behavior protection: Enabled\n  - Memory scanning: Enabled (detects in-memory attacks)\n  - Code injection: Enabled\n\nRansomware:\n  - Ransomware protection: Enabled\n  - Shadow copy protection: Enabled\n  - MBR protection: Enabled\n```\n\n**Create separate policies for**:\n- Workstations (aggressive settings)\n- Servers (moderate settings to avoid false positives on server workloads)\n- Critical infrastructure (maximum protection with exception lists)\n\n### Step 6: Configure Response Policies\n\n```\nReal-Time Response:\n  - Enable RTR for all sensor groups\n  - Configure RTR admin vs. RTR responder roles\n  - Enable script execution (for IR teams)\n  - Enable file extraction (for forensics)\n\nNetwork Containment:\n  - Pre-authorize containment for specific host groups\n  - Configure containment exclusions (allow management traffic)\n\nAutomated Response:\n  - Enable automated remediation for high-confidence detections\n  - Configure kill process action for ransomware detections\n  - Enable quarantine for malware file detections\n```\n\n### Step 7: Validate Deployment\n\n```powershell\n# Windows: Check Falcon sensor status\nsc query csagent\n# Expected: RUNNING\n\n# Check sensor version\nreg query \"HKLM\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default\" \u002Fv AgentVersion\n\n# Verify cloud connectivity\n# In Falcon Console: Host Management → Hosts → search for hostname\n# Status should show \"Online\" with last seen timestamp \u003C 5 minutes\n```\n\n**Test detection capability**:\n```powershell\n# CrowdStrike provides test detection samples\n# Download CsTestDetect.exe from Falcon Console → Host setup\n# Run on endpoint to generate a test detection\n.\\CsTestDetect.exe\n# Verify detection appears in Falcon Console within 60 seconds\n```\n\n### Step 8: SIEM Integration\n\n```\n# Falcon SIEM Connector (Streaming API)\n# Configure in Falcon Console: Support → API Clients and Keys\n\n# Create API client with scope: Event Streams → Read\n# Use falcon-siem-connector or Falcon Data Replicator (FDR)\n\n# Splunk integration:\n# Install CrowdStrike Falcon Event Streams Technical Add-on from Splunkbase\n# Configure: Settings → Data inputs → CrowdStrike Falcon Event Streams\n# Enter API Client ID and Secret\n# Index: crowdstrike_events\n\n# Elastic integration:\n# Use Elastic Agent with CrowdStrike module\n# Configure: Fleet → Agent policies → Add integration → CrowdStrike\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Falcon Sensor** | Lightweight kernel-mode agent (25-30 MB) that collects endpoint telemetry and enforces prevention policies |\n| **CID (Customer ID)** | Unique identifier that associates the sensor with your CrowdStrike Falcon tenant |\n| **RFM (Reduced Functionality Mode)** | State where sensor operates with limited capability due to cloud connectivity loss |\n| **Sensor Grouping Tags** | Labels applied during installation to auto-assign hosts to groups and policies |\n| **RTR (Real-Time Response)** | Remote shell capability for incident responders to interact with endpoints through Falcon |\n| **IOA (Indicators of Attack)** | Behavioral detections based on adversary techniques rather than static signatures |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon Console**: Cloud-hosted management platform for all Falcon modules\n- **Falcon SIEM Connector**: Streams detection and audit events to SIEM platforms\n- **Falcon Data Replicator (FDR)**: Streams raw endpoint telemetry to S3\u002Fcloud storage for hunting\n- **CrowdStrike Falcon API (OAuth2)**: RESTful API for automation, integration, and custom workflows\n- **PSFalcon**: PowerShell module for CrowdStrike Falcon API automation\n\n## Common Pitfalls\n\n- **Missing CID during installation**: Sensor installs but never connects to Falcon cloud. Always pass CID during install, not after.\n- **Proxy not configured**: In environments with web proxies, configure proxy during installation: `\u002Finstall \u002Fquiet CID=\u003CCID> APP_PROXYNAME=proxy.corp.com APP_PROXYPORT=8080`.\n- **macOS System Extension blocked**: macOS requires explicit approval for kernel\u002Fsystem extensions. Use MDM to pre-approve CrowdStrike extensions before deployment.\n- **Conflicting security products**: Running multiple EDR\u002FAV products causes performance issues and false positives. Coordinate exclusions or remove legacy AV before Falcon deployment.\n- **Sensor version pinning**: Falcon auto-updates sensors by default. Pin sensor versions in the console for change-controlled environments before testing new versions.\n","# Deploying EDR Agent with CrowdStrike\n\n## When to Use\n\nUse this skill when:\n- Deploying CrowdStrike Falcon sensors to Windows, macOS, or Linux endpoints\n- Configuring Falcon prevention and detection policies for different endpoint groups\n- Integrating CrowdStrike telemetry with SIEM (Splunk, Elastic, Sentinel) for correlated detection\n- Troubleshooting sensor connectivity, performance, or detection issues\n\n**Do not use** this skill for deploying other EDR solutions (Carbon Black, SentinelOne) or for Falcon cloud workload protection (use cloud-specific deployment guides).\n\n## Prerequisites\n\n- CrowdStrike Falcon console access with Falcon Administrator role\n- Customer ID (CID) and Falcon sensor installer package\n- Administrative\u002Froot access on target endpoints\n- Network access: endpoints must reach CrowdStrike cloud (ts01-b.cloudsink.net on port 443)\n- Deployment tool: SCCM, Intune, GPO, Ansible, or manual installation\n\n## Workflow\n\n### Step 1: Obtain Falcon Sensor Installer and CID\n\n```\n1. Log into Falcon Console: https:\u002F\u002Ffalcon.crowdstrike.com\n2. Navigate: Host setup and management → Sensor downloads\n3. Download the appropriate installer:\n   - Windows: WindowsSensor_\u003Cversion>.exe\n   - macOS: FalconSensorMacOS_\u003Cversion>.pkg\n   - Linux: falcon-sensor_\u003Cversion>_amd64.deb \u002F .rpm\n4. Copy the Customer ID (CID) from the Sensor downloads page\n   - CID format: \u003C32-char-hex>-\u003C2-char-checksum>\n```\n\n### Step 2: Deploy Falcon Sensor - Windows\n\n**Silent installation via command line**:\n```cmd\nWindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CYOUR_CID>\n```\n\n**SCCM deployment**:\n```\n1. Create an Application in SCCM\n2. Deployment type: Script Installer\n3. Install command: WindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\n4. Detection method: Registry key exists\n   - HKLM\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default\n5. Deploy to target collection\n6. Deployment purpose: Required (for mandatory installation)\n```\n\n**Microsoft Intune deployment**:\n```\n1. Navigate: Devices → Windows → Configuration profiles\n2. Create Win32 app deployment\n3. Upload .intunewin package (wrapped sensor installer)\n4. Install command: WindowsSensor_7.18.17106.exe \u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\n5. Detection rule: File exists C:\\Windows\\System32\\drivers\\CrowdStrike\\csagent.sys\n6. Assign to device group\n```\n\n**GPO deployment**:\n```powershell\n# Create startup script that checks for existing installation\n$sensorPath = \"C:\\Windows\\System32\\drivers\\CrowdStrike\\csagent.sys\"\nif (-not (Test-Path $sensorPath)) {\n    Start-Process -FilePath \"\\\\fileserver\\CrowdStrike\\WindowsSensor.exe\" `\n      -ArgumentList \"\u002Finstall \u002Fquiet \u002Fnorestart CID=\u003CCID>\" -Wait\n}\n```\n\n### Step 3: Deploy Falcon Sensor - Linux\n\n```bash\n# Debian\u002FUbuntu\nsudo dpkg -i falcon-sensor_7.18.0-17106_amd64.deb\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -s -f --cid=\u003CYOUR_CID>\nsudo systemctl start falcon-sensor\nsudo systemctl enable falcon-sensor\n\n# RHEL\u002FCentOS\nsudo yum install falcon-sensor-7.18.0-17106.el8.x86_64.rpm\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -s -f --cid=\u003CYOUR_CID>\nsudo systemctl start falcon-sensor\nsudo systemctl enable falcon-sensor\n\n# Verify sensor is running and connected\nsudo \u002Fopt\u002FCrowdStrike\u002Ffalconctl -g --rfm-state\n# Expected output: rfm-state=false (sensor is communicating with cloud)\n```\n\n### Step 4: Deploy Falcon Sensor - macOS\n\n```bash\n# Install sensor package\nsudo installer -pkg FalconSensorMacOS_7.18.pkg -target \u002F\n\n# Set CID\nsudo \u002FApplications\u002FFalcon.app\u002FContents\u002FResources\u002Ffalconctl license \u003CYOUR_CID>\n\n# Grant Full Disk Access and System Extension via MDM profile\n# Required for macOS Ventura+ (manual approval or MDM PPPC profile)\n# MDM payload: com.crowdstrike.falcon.Agent → SystemExtension + Full Disk Access\n\n# Verify sensor status\nsudo \u002FApplications\u002FFalcon.app\u002FContents\u002FResources\u002Ffalconctl stats\n```\n\n### Step 5: Configure Prevention Policies\n\nIn Falcon Console, navigate to Configuration → Prevention Policies:\n\n**Recommended prevention policy settings**:\n```\nMachine Learning:\n  - Cloud ML: Aggressive (extra protection, may increase false positives)\n  - Sensor ML: Moderate\n  - Adware & PUP: Moderate\n\nBehavioral Protection:\n  - On Write: Enabled (detect malware on file creation)\n  - On Sensor ML: Enabled\n  - Interpreter-Only: Enabled (detect script-based attacks)\n\nExploit Mitigation:\n  - Exploit behavior protection: Enabled\n  - Memory scanning: Enabled (detects in-memory attacks)\n  - Code injection: Enabled\n\nRansomware:\n  - Ransomware protection: Enabled\n  - Shadow copy protection: Enabled\n  - MBR protection: Enabled\n```\n\n**Create separate policies for**:\n- Workstations (aggressive settings)\n- Servers (moderate settings to avoid false positives on server workloads)\n- Critical infrastructure (maximum protection with exception lists)\n\n### Step 6: Configure Response Policies\n\n```\nReal-Time Response:\n  - Enable RTR for all sensor groups\n  - Configure RTR admin vs. RTR responder roles\n  - Enable script execution (for IR teams)\n  - Enable file extraction (for forensics)\n\nNetwork Containment:\n  - Pre-authorize containment for specific host groups\n  - Configure containment exclusions (allow management traffic)\n\nAutomated Response:\n  - Enable automated remediation for high-confidence detections\n  - Configure kill process action for ransomware detections\n  - Enable quarantine for malware file detections\n```\n\n### Step 7: Validate Deployment\n\n```powershell\n# Windows: Check Falcon sensor status\nsc query csagent\n# Expected: RUNNING\n\n# Check sensor version\nreg query \"HKLM\\SYSTEM\\CrowdStrike\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\{16e0423f-7058-48c9-a204-725362b67639}\\Default\" \u002Fv AgentVersion\n\n# Verify cloud connectivity\n# In Falcon Console: Host Management → Hosts → search for hostname\n# Status should show \"Online\" with last seen timestamp \u003C 5 minutes\n```\n\n**Test detection capability**:\n```powershell\n# CrowdStrike provides test detection samples\n# Download CsTestDetect.exe from Falcon Console → Host setup\n# Run on endpoint to generate a test detection\n.\\CsTestDetect.exe\n# Verify detection appears in Falcon Console within 60 seconds\n```\n\n### Step 8: SIEM Integration\n\n```\n# Falcon SIEM Connector (Streaming API)\n# Configure in Falcon Console: Support → API Clients and Keys\n\n# Create API client with scope: Event Streams → Read\n# Use falcon-siem-connector or Falcon Data Replicator (FDR)\n\n# Splunk integration:\n# Install CrowdStrike Falcon Event Streams Technical Add-on from Splunkbase\n# Configure: Settings → Data inputs → CrowdStrike Falcon Event Streams\n# Enter API Client ID and Secret\n# Index: crowdstrike_events\n\n# Elastic integration:\n# Use Elastic Agent with CrowdStrike module\n# Configure: Fleet → Agent policies → Add integration → CrowdStrike\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Falcon Sensor** | Lightweight kernel-mode agent (25-30 MB) that collects endpoint telemetry and enforces prevention policies |\n| **CID (Customer ID)** | Unique identifier that associates the sensor with your CrowdStrike Falcon tenant |\n| **RFM (Reduced Functionality Mode)** | State where sensor operates with limited capability due to cloud connectivity loss |\n| **Sensor Grouping Tags** | Labels applied during installation to auto-assign hosts to groups and policies |\n| **RTR (Real-Time Response)** | Remote shell capability for incident responders to interact with endpoints through Falcon |\n| **IOA (Indicators of Attack)** | Behavioral detections based on adversary techniques rather than static signatures |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon Console**: Cloud-hosted management platform for all Falcon modules\n- **Falcon SIEM Connector**: Streams detection and audit events to SIEM platforms\n- **Falcon Data Replicator (FDR)**: Streams raw endpoint telemetry to S3\u002Fcloud storage for hunting\n- **CrowdStrike Falcon API (OAuth2)**: RESTful API for automation, integration, and custom workflows\n- **PSFalcon**: PowerShell module for CrowdStrike Falcon API automation\n\n## Common Pitfalls\n\n- **Missing CID during installation**: Sensor installs but never connects to Falcon cloud. Always pass CID during install, not after.\n- **Proxy not configured**: In environments with web proxies, configure proxy during installation: `\u002Finstall \u002Fquiet CID=\u003CCID> APP_PROXYNAME=proxy.corp.com APP_PROXYPORT=8080`.\n- **macOS System Extension blocked**: macOS requires explicit approval for kernel\u002Fsystem extensions. Use MDM to pre-approve CrowdStrike extensions before deployment.\n- **Conflicting security products**: Running multiple EDR\u002FAV products causes performance issues and false positives. Coordinate exclusions or remove legacy AV before Falcon deployment.\n- **Sensor version pinning**: Falcon auto-updates sensors by default. Pin sensor versions in the console for change-controlled environments before testing new versions.\n",{"name":5,"tags":48,"author":49,"domain":41,"license":15,"version":50,"nist_csf":51,"subdomain":32,"description":56,"nist_ai_rmf":57,"mitre_attack":63,"atlas_techniques":68},[31,29,28,27,35,26],"mahipal","1.0.0",[52,53,54,55],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.\n",[58,59,60,61,62],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4",[64,65,33,66,67],"T1003.001","T1055","T1486","T1071.001",[69,70,71],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeploying-edr-agent-with-crowdstrike",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-edr-agent-with-crowdstrike",{"tool":88,"command":89},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-edr-agent-with-crowdstrike",{"tool":91,"command":92},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-edr-agent-with-crowdstrike","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002FSKILL.md",true,[96,102,107,113,117,121,125,131],{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"assets\u002Ftemplate.md","ASSET","资产文件",3006,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Fassets\u002Ftemplate.md",{"path":103,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002FLICENSE",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fapi-reference.md","REFERENCE","参考文档",1458,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Freferences\u002Fapi-reference.md",{"path":114,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fexample.md",1133,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthinking-method-selector\u002Freferences\u002Fexample.md",{"path":118,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fstandards.md",2546,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Freferences\u002Fstandards.md",{"path":122,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fworkflows.md",4539,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Freferences\u002Fworkflows.md",{"path":126,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fagent.py","SCRIPT","脚本",4694,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Fscripts\u002Fagent.py",{"path":132,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fprocess.py",8608,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-edr-agent-with-crowdstrike\u002Fscripts\u002Fprocess.py",[136,161,184,211,237,264],{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[142],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[144,145,146,147,34,41,148,149,38,150,151,152,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,34,42,41,38,172,173,174,175,176,177,178,179,180,181,182,183],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":194,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[190,193],{"categoryNo":191,"categoryName":192,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[178,195,196,197,198,41,199,200,172,201,202,203,204,205,30,206,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,41,222,223,224,225,226,227,228,229,230,231,232,233,175,234,235,236],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[245,246,247,41,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":268,"categories":269,"keywords":271,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[270],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,272,41,40,273,274,275,276,277,278,29,206,279,207,280,281,282,283,284,285],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]