[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF062R9NX6GAWKXG49CW5V":3,"skill-same:01M6AF062R9NX6GAWKXG49CW5V":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":80,"repositoryHtmlUrl":81,"repositoryHomepageUrl":82,"ownerHtmlUrl":83,"ownerBlogUrl":84,"ownerDescription":85,"updatedAt":86,"install":87,"resources":100},"01M6AF062R9NX6GAWKXG49CW5V","implementing-aws-macie-for-data-classification",null,"Enable and configure Amazon Macie via AWS CLI\u002FTerraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"implementing aws macie for data classification","macie","data","aws","remediation","sensitive-data","pii","data-classification","t1078","t1003","dlp","eventbridge","cli","cloud-security","compliance","s3","pr","ml","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-aws-macie-for-data-classification\ndescription: Enable and configure Amazon Macie via AWS CLI\u002FTerraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- aws\n- macie\n- data-classification\n- s3\n- pii\n- sensitive-data\n- dlp\n- compliance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0043\n- AML.T0018\nnist_ai_rmf:\n- GOVERN-1.1\n- GOVERN-4.2\n- MAP-2.3\n- MEASURE-2.7\n- MEASURE-2.5\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1003\n---\n\n# Implementing AWS Macie for Data Classification\n\n## Overview\n\nAmazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.\n\n\n## When to Use\n\n- When deploying or configuring implementing aws macie for data classification capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS account with S3 buckets containing data to classify\n- IAM permissions for Macie service configuration\n- AWS Organizations setup (for multi-account deployment)\n- S3 buckets in supported regions\n\n## Enable Macie\n\n### Via AWS CLI\n\n```bash\n# Enable Macie in the current account\u002Fregion\naws macie2 enable-macie\n\n# Verify Macie is enabled\naws macie2 get-macie-session\n\n# Enable automated sensitive data discovery\naws macie2 update-automated-discovery-configuration \\\n  --status ENABLED\n```\n\n### Via Terraform\n\n```hcl\nresource \"aws_macie2_account\" \"main\" {}\n\nresource \"aws_macie2_classification_export_configuration\" \"main\" {\n  depends_on = [aws_macie2_account.main]\n\n  s3_destination {\n    bucket_name = aws_s3_bucket.macie_results.id\n    key_prefix  = \"macie-findings\u002F\"\n    kms_key_arn = aws_kms_key.macie.arn\n  }\n}\n```\n\n## Configure Discovery Jobs\n\n### Create a classification job for specific buckets\n\n```bash\naws macie2 create-classification-job \\\n  --job-type ONE_TIME \\\n  --name \"pii-scan-production-buckets\" \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"123456789012\",\n      \"buckets\": [\n        \"production-data-bucket\",\n        \"customer-records-bucket\"\n      ]\n    }]\n  }' \\\n  --managed-data-identifier-selector ALL\n```\n\n### Create a scheduled recurring job\n\n```bash\naws macie2 create-classification-job \\\n  --job-type SCHEDULED \\\n  --name \"weekly-sensitive-data-scan\" \\\n  --schedule-frequency-details '{\n    \"weekly\": {\n      \"dayOfWeek\": \"MONDAY\"\n    }\n  }' \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"123456789012\",\n      \"buckets\": [\"all-data-bucket\"]\n    }],\n    \"scoping\": {\n      \"includes\": {\n        \"and\": [{\n          \"simpleScopeTerm\": {\n            \"comparator\": \"STARTS_WITH\",\n            \"key\": \"OBJECT_KEY\",\n            \"values\": [\"uploads\u002F\", \"documents\u002F\"]\n          }\n        }]\n      }\n    }\n  }'\n```\n\n## Custom Data Identifiers\n\n### Create a custom identifier for internal IDs\n\n```bash\naws macie2 create-custom-data-identifier \\\n  --name \"internal-employee-id\" \\\n  --description \"Matches internal employee ID format EMP-XXXXXX\" \\\n  --regex \"EMP-[0-9]{6}\" \\\n  --severity-levels '[\n    {\"occurrencesThreshold\": 1, \"severity\": \"LOW\"},\n    {\"occurrencesThreshold\": 10, \"severity\": \"MEDIUM\"},\n    {\"occurrencesThreshold\": 50, \"severity\": \"HIGH\"}\n  ]'\n```\n\n### Create identifier for project codes\n\n```bash\naws macie2 create-custom-data-identifier \\\n  --name \"project-code-identifier\" \\\n  --description \"Matches project codes in format PRJ-XXXX-XX\" \\\n  --regex \"PRJ-[A-Z]{4}-[0-9]{2}\" \\\n  --keywords '[\"project\", \"code\", \"initiative\"]' \\\n  --maximum-match-distance 50\n```\n\n## Allow Lists\n\n### Create an allow list to suppress false positives\n\n```bash\naws macie2 create-allow-list \\\n  --name \"test-data-exclusions\" \\\n  --description \"Exclude known test data patterns\" \\\n  --criteria '{\n    \"regex\": \"TEST-[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}\"\n  }'\n```\n\n## Managed Data Identifiers\n\nMacie provides 300+ managed data identifiers covering:\n\n| Category | Examples |\n|----------|---------|\n| **PII** | SSN, passport numbers, driver's license, date of birth, names, addresses |\n| **Financial** | Credit card numbers, bank account numbers, SWIFT codes |\n| **Credentials** | AWS secret keys, API keys, SSH private keys, OAuth tokens |\n| **Health** | HIPAA identifiers, health insurance claim numbers |\n| **Legal** | Tax identification numbers, national ID numbers |\n\n## Findings Management\n\n### List findings\n\n```bash\n# Get sensitive data findings\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"severity.description\": {\n        \"eq\": [\"High\"]\n      },\n      \"category\": {\n        \"eq\": [\"CLASSIFICATION\"]\n      }\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}' \\\n  --max-results 25\n```\n\n### Get finding details\n\n```bash\naws macie2 get-findings \\\n  --finding-ids '[\"finding-id-1\", \"finding-id-2\"]'\n```\n\n### Export findings to Security Hub\n\n```bash\n# Macie automatically publishes findings to Security Hub\n# Verify integration:\naws macie2 get-macie-session --query 'findingPublishingFrequency'\n```\n\n## EventBridge Integration for Automated Response\n\n```json\n{\n  \"source\": [\"aws.macie\"],\n  \"detail-type\": [\"Macie Finding\"],\n  \"detail\": {\n    \"severity\": {\n      \"description\": [\"High\", \"Critical\"]\n    }\n  }\n}\n```\n\n### Lambda function for automated remediation\n\n```python\nimport boto3\nimport json\n\ns3 = boto3.client('s3')\nsns = boto3.client('sns')\n\ndef lambda_handler(event, context):\n    finding = event['detail']\n    severity = finding['severity']['description']\n    bucket = finding['resourcesAffected']['s3Bucket']['name']\n    key = finding['resourcesAffected']['s3Object']['key']\n    sensitive_types = [d['type'] for d in finding.get('classificationDetails', {}).get('result', {}).get('sensitiveData', [])]\n\n    if severity in ['High', 'Critical']:\n        # Tag the object for review\n        s3.put_object_tagging(\n            Bucket=bucket,\n            Key=key,\n            Tagging={\n                'TagSet': [\n                    {'Key': 'macie-finding', 'Value': severity},\n                    {'Key': 'sensitive-data', 'Value': ','.join(sensitive_types)},\n                    {'Key': 'requires-review', 'Value': 'true'}\n                ]\n            }\n        )\n\n        # Notify security team\n        sns.publish(\n            TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',\n            Subject=f'Macie {severity} Finding: {bucket}\u002F{key}',\n            Message=json.dumps({\n                'bucket': bucket,\n                'key': key,\n                'severity': severity,\n                'sensitive_data_types': sensitive_types,\n                'finding_id': finding['id']\n            }, indent=2)\n        )\n\n    return {'statusCode': 200}\n```\n\n## Multi-Account Deployment\n\n### Designate Macie administrator account\n\n```bash\n# From the management account\naws macie2 enable-organization-admin-account \\\n  --admin-account-id 111111111111\n```\n\n### Add member accounts\n\n```bash\n# From the administrator account\naws macie2 create-member \\\n  --account '{\"accountId\": \"222222222222\", \"email\": \"security@example.com\"}'\n```\n\n## Monitoring Macie Operations\n\n### Usage statistics\n\n```bash\naws macie2 get-usage-statistics \\\n  --filter-by '[{\"comparator\": \"GT\", \"key\": \"accountId\", \"values\": []}]' \\\n  --sort-by '{\"key\": \"accountId\", \"orderBy\": \"ASC\"}'\n```\n\n### Classification job status\n\n```bash\naws macie2 list-classification-jobs \\\n  --filter-criteria '{\"includes\": [{\"comparator\": \"EQ\", \"key\": \"jobStatus\", \"values\": [\"RUNNING\"]}]}'\n```\n\n## References\n\n- AWS Macie Documentation: https:\u002F\u002Fdocs.aws.amazon.com\u002Fmacie\u002F\n- AWS Macie Pricing\n- Supported File Types for Macie Analysis\n- GDPR and CCPA Compliance with Macie\n","# Implementing AWS Macie for Data Classification\n\n## Overview\n\nAmazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically evaluates your S3 bucket inventory on a daily basis and identifies objects containing PII, financial information, credentials, and other sensitive data types. It provides two discovery approaches: automated sensitive data discovery for broad visibility and targeted discovery jobs for deep analysis.\n\n\n## When to Use\n\n- When deploying or configuring implementing aws macie for data classification capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- AWS account with S3 buckets containing data to classify\n- IAM permissions for Macie service configuration\n- AWS Organizations setup (for multi-account deployment)\n- S3 buckets in supported regions\n\n## Enable Macie\n\n### Via AWS CLI\n\n```bash\n# Enable Macie in the current account\u002Fregion\naws macie2 enable-macie\n\n# Verify Macie is enabled\naws macie2 get-macie-session\n\n# Enable automated sensitive data discovery\naws macie2 update-automated-discovery-configuration \\\n  --status ENABLED\n```\n\n### Via Terraform\n\n```hcl\nresource \"aws_macie2_account\" \"main\" {}\n\nresource \"aws_macie2_classification_export_configuration\" \"main\" {\n  depends_on = [aws_macie2_account.main]\n\n  s3_destination {\n    bucket_name = aws_s3_bucket.macie_results.id\n    key_prefix  = \"macie-findings\u002F\"\n    kms_key_arn = aws_kms_key.macie.arn\n  }\n}\n```\n\n## Configure Discovery Jobs\n\n### Create a classification job for specific buckets\n\n```bash\naws macie2 create-classification-job \\\n  --job-type ONE_TIME \\\n  --name \"pii-scan-production-buckets\" \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"123456789012\",\n      \"buckets\": [\n        \"production-data-bucket\",\n        \"customer-records-bucket\"\n      ]\n    }]\n  }' \\\n  --managed-data-identifier-selector ALL\n```\n\n### Create a scheduled recurring job\n\n```bash\naws macie2 create-classification-job \\\n  --job-type SCHEDULED \\\n  --name \"weekly-sensitive-data-scan\" \\\n  --schedule-frequency-details '{\n    \"weekly\": {\n      \"dayOfWeek\": \"MONDAY\"\n    }\n  }' \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"123456789012\",\n      \"buckets\": [\"all-data-bucket\"]\n    }],\n    \"scoping\": {\n      \"includes\": {\n        \"and\": [{\n          \"simpleScopeTerm\": {\n            \"comparator\": \"STARTS_WITH\",\n            \"key\": \"OBJECT_KEY\",\n            \"values\": [\"uploads\u002F\", \"documents\u002F\"]\n          }\n        }]\n      }\n    }\n  }'\n```\n\n## Custom Data Identifiers\n\n### Create a custom identifier for internal IDs\n\n```bash\naws macie2 create-custom-data-identifier \\\n  --name \"internal-employee-id\" \\\n  --description \"Matches internal employee ID format EMP-XXXXXX\" \\\n  --regex \"EMP-[0-9]{6}\" \\\n  --severity-levels '[\n    {\"occurrencesThreshold\": 1, \"severity\": \"LOW\"},\n    {\"occurrencesThreshold\": 10, \"severity\": \"MEDIUM\"},\n    {\"occurrencesThreshold\": 50, \"severity\": \"HIGH\"}\n  ]'\n```\n\n### Create identifier for project codes\n\n```bash\naws macie2 create-custom-data-identifier \\\n  --name \"project-code-identifier\" \\\n  --description \"Matches project codes in format PRJ-XXXX-XX\" \\\n  --regex \"PRJ-[A-Z]{4}-[0-9]{2}\" \\\n  --keywords '[\"project\", \"code\", \"initiative\"]' \\\n  --maximum-match-distance 50\n```\n\n## Allow Lists\n\n### Create an allow list to suppress false positives\n\n```bash\naws macie2 create-allow-list \\\n  --name \"test-data-exclusions\" \\\n  --description \"Exclude known test data patterns\" \\\n  --criteria '{\n    \"regex\": \"TEST-[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}\"\n  }'\n```\n\n## Managed Data Identifiers\n\nMacie provides 300+ managed data identifiers covering:\n\n| Category | Examples |\n|----------|---------|\n| **PII** | SSN, passport numbers, driver's license, date of birth, names, addresses |\n| **Financial** | Credit card numbers, bank account numbers, SWIFT codes |\n| **Credentials** | AWS secret keys, API keys, SSH private keys, OAuth tokens |\n| **Health** | HIPAA identifiers, health insurance claim numbers |\n| **Legal** | Tax identification numbers, national ID numbers |\n\n## Findings Management\n\n### List findings\n\n```bash\n# Get sensitive data findings\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"severity.description\": {\n        \"eq\": [\"High\"]\n      },\n      \"category\": {\n        \"eq\": [\"CLASSIFICATION\"]\n      }\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}' \\\n  --max-results 25\n```\n\n### Get finding details\n\n```bash\naws macie2 get-findings \\\n  --finding-ids '[\"finding-id-1\", \"finding-id-2\"]'\n```\n\n### Export findings to Security Hub\n\n```bash\n# Macie automatically publishes findings to Security Hub\n# Verify integration:\naws macie2 get-macie-session --query 'findingPublishingFrequency'\n```\n\n## EventBridge Integration for Automated Response\n\n```json\n{\n  \"source\": [\"aws.macie\"],\n  \"detail-type\": [\"Macie Finding\"],\n  \"detail\": {\n    \"severity\": {\n      \"description\": [\"High\", \"Critical\"]\n    }\n  }\n}\n```\n\n### Lambda function for automated remediation\n\n```python\nimport boto3\nimport json\n\ns3 = boto3.client('s3')\nsns = boto3.client('sns')\n\ndef lambda_handler(event, context):\n    finding = event['detail']\n    severity = finding['severity']['description']\n    bucket = finding['resourcesAffected']['s3Bucket']['name']\n    key = finding['resourcesAffected']['s3Object']['key']\n    sensitive_types = [d['type'] for d in finding.get('classificationDetails', {}).get('result', {}).get('sensitiveData', [])]\n\n    if severity in ['High', 'Critical']:\n        # Tag the object for review\n        s3.put_object_tagging(\n            Bucket=bucket,\n            Key=key,\n            Tagging={\n                'TagSet': [\n                    {'Key': 'macie-finding', 'Value': severity},\n                    {'Key': 'sensitive-data', 'Value': ','.join(sensitive_types)},\n                    {'Key': 'requires-review', 'Value': 'true'}\n                ]\n            }\n        )\n\n        # Notify security team\n        sns.publish(\n            TopicArn='arn:aws:sns:us-east-1:123456789012:security-alerts',\n            Subject=f'Macie {severity} Finding: {bucket}\u002F{key}',\n            Message=json.dumps({\n                'bucket': bucket,\n                'key': key,\n                'severity': severity,\n                'sensitive_data_types': sensitive_types,\n                'finding_id': finding['id']\n            }, indent=2)\n        )\n\n    return {'statusCode': 200}\n```\n\n## Multi-Account Deployment\n\n### Designate Macie administrator account\n\n```bash\n# From the management account\naws macie2 enable-organization-admin-account \\\n  --admin-account-id 111111111111\n```\n\n### Add member accounts\n\n```bash\n# From the administrator account\naws macie2 create-member \\\n  --account '{\"accountId\": \"222222222222\", \"email\": \"security@example.com\"}'\n```\n\n## Monitoring Macie Operations\n\n### Usage statistics\n\n```bash\naws macie2 get-usage-statistics \\\n  --filter-by '[{\"comparator\": \"GT\", \"key\": \"accountId\", \"values\": []}]' \\\n  --sort-by '{\"key\": \"accountId\", \"orderBy\": \"ASC\"}'\n```\n\n### Classification job status\n\n```bash\naws macie2 list-classification-jobs \\\n  --filter-criteria '{\"includes\": [{\"comparator\": \"EQ\", \"key\": \"jobStatus\", \"values\": [\"RUNNING\"]}]}'\n```\n\n## References\n\n- AWS Macie Documentation: https:\u002F\u002Fdocs.aws.amazon.com\u002Fmacie\u002F\n- AWS Macie Pricing\n- Supported File Types for Macie Analysis\n- GDPR and CCPA Compliance with Macie\n",{"name":5,"tags":54,"author":55,"domain":47,"license":15,"version":56,"nist_csf":57,"subdomain":42,"description":7,"nist_ai_rmf":62,"mitre_attack":68,"atlas_techniques":74},[32,30,36,44,35,34,39,43],"mahipal","1.0",[58,59,60,61],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[63,64,65,66,67],"GOVERN-1.1","GOVERN-4.2","MAP-2.3","MEASURE-2.7","MEASURE-2.5",[69,70,71,72,73],"T1078.004","T1530","T1537","T1580","T1003",[75,76],"AML.T0043","AML.T0018","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-aws-macie-for-data-classification",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":88,"prompt":98,"zipAvailable":99},[89,92,95],{"tool":90,"command":91},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-macie-for-data-classification",{"tool":93,"command":94},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-macie-for-data-classification",{"tool":96,"command":97},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-macie-for-data-classification","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002FSKILL.md",true,[101,107,112,118,122,126,132],{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"assets\u002Ftemplate.md","ASSET","资产文件",775,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Fassets\u002Ftemplate.md",{"path":108,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002FLICENSE",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fapi-reference.md","REFERENCE","参考文档",2080,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Freferences\u002Fapi-reference.md",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fstandards.md",625,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Freferences\u002Fstandards.md",{"path":123,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fworkflows.md",823,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Freferences\u002Fworkflows.md",{"path":127,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fagent.py","SCRIPT","脚本",6102,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Fscripts\u002Fagent.py",{"path":133,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fprocess.py",5678,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-macie-for-data-classification\u002Fscripts\u002Fprocess.py",[137,164,188,214,239,265],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":146,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[147,148,149,150,48,47,151,152,45,153,154,155,156,157,158,159,160,161,162,163],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":171,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[170],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[172,160,173,174,48,175,47,45,176,177,178,179,180,181,182,183,184,185,186,187],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":198,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[194,197],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[182,199,200,201,202,47,203,204,176,43,205,206,207,208,209,37,210,211,212,213],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":221,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[220],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[222,223,224,47,225,226,227,228,229,230,231,31,232,233,234,235,179,236,237,238],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[245],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[247,248,249,47,250,251,252,253,254,255,256,257,258,33,259,260,261,262,263,264],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":266,"name":267,"nameZh":6,"description":268,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":269,"categories":270,"keywords":272,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[271],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},[48,273,47,274,275,276,277,278,279,280,281,37,282,210,283,284,285,286,287,288],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]