[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AETT4PY5EV4NFC38HXT0JK":3,"skill-same:01M6AETT4PY5EV4NFC38HXT0JK":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AETT4PY5EV4NFC38HXT0JK","hunting-for-command-and-control-beaconing",null,"Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"beaconing","hunting for command and control beaconing","cybersecurity","infrastructure","validation","protocol","content","metadata","file","mitre-attack","threat-hunting","c2","network","network-analysis","proactive-detection","detection","2026-11-10 10:12:30",false,"---\nname: hunting-for-command-and-control-beaconing\ndescription: Detect C2 beaconing patterns in network traffic using frequency analysis,\n  jitter detection, and domain reputation to identify compromised endpoints communicating\n  with adversary infrastructure.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- c2\n- beaconing\n- network-analysis\n- proactive-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Certificate Analysis\n- Application Protocol Command Analysis\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1071\n---\n\n# Hunting for Command and Control Beaconing\n\n## When to Use\n\n- When proactively hunting for compromised systems in the network\n- After threat intel indicates C2 frameworks targeting your industry\n- When investigating periodic outbound connections to suspicious domains\n- During incident response to identify active C2 channels\n- When DNS query logs show unusual patterns to specific domains\n\n## Prerequisites\n\n- Network proxy\u002Ffirewall logs with full URL and timing data\n- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)\n- Zeek\u002FBro network connection logs or NetFlow data\n- SIEM with statistical analysis capabilities (Splunk, Elastic)\n- Threat intelligence feeds for domain\u002FIP reputation\n\n## Workflow\n\n1. **Identify Beaconing Characteristics**: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).\n2. **Collect Network Telemetry**: Aggregate proxy logs, DNS queries, and connection metadata for analysis.\n3. **Apply Frequency Analysis**: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).\n4. **Filter Known-Good Traffic**: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).\n5. **Analyze Domain\u002FIP Reputation**: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.\n6. **Investigate Endpoint Context**: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.\n7. **Confirm and Respond**: Validate C2 activity, block communication, and initiate incident response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol (HTTP\u002FHTTPS\u002FDNS C2) |\n| T1071.001 | Web Protocols (HTTP\u002FS beaconing) |\n| T1071.004 | DNS (DNS tunneling C2) |\n| T1573 | Encrypted Channel |\n| T1572 | Protocol Tunneling |\n| T1568 | Dynamic Resolution (DGA, fast-flux) |\n| T1132 | Data Encoding in C2 |\n| T1095 | Non-Application Layer Protocol |\n| Beacon Interval | Time between C2 check-ins |\n| Jitter | Random variation in beacon interval |\n| DGA | Domain Generation Algorithm |\n| Fast-Flux | Rapidly changing DNS resolution |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |\n| Splunk | Statistical beacon analysis with SPL |\n| Elastic Security | ML-based anomaly detection for beaconing |\n| Zeek\u002FBro | Network connection metadata collection |\n| Suricata | Network IDS with JA3\u002FJA4 fingerprinting |\n| VirusTotal | Domain and IP reputation checking |\n| PassiveDNS | Historical DNS resolution data |\n| Flare | C2 profile detection |\n\n## Common Scenarios\n\n1. **Cobalt Strike Beacon**: HTTP\u002FHTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.\n2. **DNS Tunneling C2**: Data exfiltration and command receipt via encoded DNS TXT\u002FCNAME queries to attacker-controlled domains.\n3. **Sliver C2 over HTTPS**: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.\n4. **DGA-based C2**: Malware generating random domains daily, with adversary registering upcoming domains for C2.\n5. **Legitimate Service Abuse**: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).\n\n## Output Format\n\n```\nHunt ID: TH-C2-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nDestination: [Domain\u002FIP]\nProtocol: [HTTP\u002FHTTPS\u002FDNS\u002FCustom]\nBeacon Interval: [Average seconds]\nJitter: [Percentage]\nConnection Count: [Total connections]\nData Volume: [Bytes sent\u002Freceived]\nFirst Seen: [Timestamp]\nLast Seen: [Timestamp]\nDomain Age: [Days]\nTI Match: [Yes\u002FNo - source]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Hunting for Command and Control Beaconing\n\n## When to Use\n\n- When proactively hunting for compromised systems in the network\n- After threat intel indicates C2 frameworks targeting your industry\n- When investigating periodic outbound connections to suspicious domains\n- During incident response to identify active C2 channels\n- When DNS query logs show unusual patterns to specific domains\n\n## Prerequisites\n\n- Network proxy\u002Ffirewall logs with full URL and timing data\n- DNS query logs (passive DNS, DNS server logs, or Sysmon Event ID 22)\n- Zeek\u002FBro network connection logs or NetFlow data\n- SIEM with statistical analysis capabilities (Splunk, Elastic)\n- Threat intelligence feeds for domain\u002FIP reputation\n\n## Workflow\n\n1. **Identify Beaconing Characteristics**: Define what constitutes beaconing (regular intervals, small payload sizes, consistent destinations, jitter patterns).\n2. **Collect Network Telemetry**: Aggregate proxy logs, DNS queries, and connection metadata for analysis.\n3. **Apply Frequency Analysis**: Identify connections with regular intervals using statistical methods (standard deviation, coefficient of variation).\n4. **Filter Known-Good Traffic**: Exclude legitimate periodic traffic (Windows Update, AV updates, heartbeat services, NTP).\n5. **Analyze Domain\u002FIP Reputation**: Check identified beaconing destinations against threat intel, WHOIS data, and certificate transparency logs.\n6. **Investigate Endpoint Context**: Correlate beaconing activity with process creation, user context, and file system changes on source endpoints.\n7. **Confirm and Respond**: Validate C2 activity, block communication, and initiate incident response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1071 | Application Layer Protocol (HTTP\u002FHTTPS\u002FDNS C2) |\n| T1071.001 | Web Protocols (HTTP\u002FS beaconing) |\n| T1071.004 | DNS (DNS tunneling C2) |\n| T1573 | Encrypted Channel |\n| T1572 | Protocol Tunneling |\n| T1568 | Dynamic Resolution (DGA, fast-flux) |\n| T1132 | Data Encoding in C2 |\n| T1095 | Non-Application Layer Protocol |\n| Beacon Interval | Time between C2 check-ins |\n| Jitter | Random variation in beacon interval |\n| DGA | Domain Generation Algorithm |\n| Fast-Flux | Rapidly changing DNS resolution |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| RITA (Real Intelligence Threat Analytics) | Automated beacon detection in Zeek logs |\n| Splunk | Statistical beacon analysis with SPL |\n| Elastic Security | ML-based anomaly detection for beaconing |\n| Zeek\u002FBro | Network connection metadata collection |\n| Suricata | Network IDS with JA3\u002FJA4 fingerprinting |\n| VirusTotal | Domain and IP reputation checking |\n| PassiveDNS | Historical DNS resolution data |\n| Flare | C2 profile detection |\n\n## Common Scenarios\n\n1. **Cobalt Strike Beacon**: HTTP\u002FHTTPS beaconing with configurable sleep time and jitter to malleable C2 profiles.\n2. **DNS Tunneling C2**: Data exfiltration and command receipt via encoded DNS TXT\u002FCNAME queries to attacker-controlled domains.\n3. **Sliver C2 over HTTPS**: Modern C2 framework using HTTPS with configurable beacon intervals and domain fronting.\n4. **DGA-based C2**: Malware generating random domains daily, with adversary registering upcoming domains for C2.\n5. **Legitimate Service Abuse**: C2 over legitimate cloud services (Azure, AWS, Slack, Discord, Telegram).\n\n## Output Format\n\n```\nHunt ID: TH-C2-[DATE]-[SEQ]\nSource IP: [Internal IP]\nSource Host: [Hostname]\nDestination: [Domain\u002FIP]\nProtocol: [HTTP\u002FHTTPS\u002FDNS\u002FCustom]\nBeacon Interval: [Average seconds]\nJitter: [Percentage]\nConnection Count: [Total connections]\nData Volume: [Bytes sent\u002Freceived]\nFirst Seen: [Timestamp]\nLast Seen: [Timestamp]\nDomain Age: [Days]\nTI Match: [Yes\u002FNo - source]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":45,"author":46,"domain":26,"license":15,"version":47,"nist_csf":48,"subdomain":34,"description":7,"mitre_attack":53,"d3fend_techniques":59},[34,33,35,24,37,38],"mahipal","1.0",[49,50,51,52],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[54,55,56,57,58],"T1046","T1057","T1082","T1083","T1071",[60,61,62,63,64],"File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fhunting-for-command-and-control-beaconing",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-command-and-control-beaconing",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-command-and-control-beaconing",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-command-and-control-beaconing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",996,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2222,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",3224,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",4360,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",6213,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",14852,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002Fscripts\u002Fprocess.py",[125,152,176,201,227,254],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135,136,137,26,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,148,161,162,137,163,26,140,164,165,166,167,168,169,170,171,172,173,174,175],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[182,185],{"categoryNo":183,"categoryName":184,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[170,187,188,189,190,26,27,28,164,191,192,193,194,195,39,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,26,212,213,214,215,216,217,218,219,220,221,222,223,167,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,26,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,262,26,263,32,264,265,266,267,268,269,196,270,197,271,272,273,274,275,276],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]