[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF0H3ZB69KD4VS3DCV2F35":3,"skill-same:01M6AF0H3ZB69KD4VS3DCV2F35":137},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AF0H3ZB69KD4VS3DCV2F35","implementing-aws-security-hub",null,"Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge\u002FSystems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"implementing aws security hub","aws","security","eventbridge","finding-aggregation","security-standards","compliance-automation","aws-security-hub","cspm","security-hub","t1078","macie","guardduty","remediation","NIST","cloud-security","audit","config","dashboard","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-aws-security-hub\ndescription: 'Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS\n  Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools;\n  enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge\u002FSystems\n  Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard\n  or compliance audit evidence; not for threat detection or container scanning.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- aws-security-hub\n- cspm\n- compliance-automation\n- security-standards\n- finding-aggregation\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Implementing AWS Security Hub\n\n## When to Use\n\n- When establishing a centralized security findings dashboard across multiple AWS accounts\n- When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices\n- When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools\n- When building automated remediation workflows for recurring security misconfigurations\n- When preparing compliance evidence for auditors requiring continuous posture monitoring\n\n**Do not use** for real-time threat detection (see detecting-cloud-threats-with-guardduty), for Azure compliance monitoring (see securing-azure-with-microsoft-defender), or for deep vulnerability scanning of container images (see securing-container-registry).\n\n## Prerequisites\n\n- AWS Organization with a designated security administrator account\n- AWS Config enabled in all target accounts and regions\n- GuardDuty, Inspector, and Macie activated for finding integration\n- IAM permissions for securityhub:* and config:* in the administrator account\n\n## Workflow\n\n### Step 1: Enable Security Hub with Standards\n\nActivate Security Hub in the delegated administrator account and enable security standards. AWS Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53.\n\n```bash\n# Enable Security Hub with standards\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --tags '{\"Environment\":\"production\",\"ManagedBy\":\"security-team\"}'\n\n# Enable CIS AWS Foundations Benchmark v5.0\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests '[\n    {\"StandardsArn\": \"arn:aws:securityhub:::ruleset\u002Fcis-aws-foundations-benchmark\u002Fv\u002F5.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fpci-dss\u002Fv\u002F3.2.1\"}\n  ]'\n\n# Verify enabled standards\naws securityhub get-enabled-standards \\\n  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table\n```\n\n### Step 2: Configure Multi-Account Aggregation\n\nDesignate a Security Hub administrator and automatically enroll all organization member accounts. Configure cross-region aggregation to consolidate findings into a single region.\n\n```bash\n# Designate delegated admin\naws securityhub enable-organization-admin-account \\\n  --admin-account-id 111122223333\n\n# Auto-enable for all org members\naws securityhub update-organization-configuration \\\n  --auto-enable \\\n  --organization-configuration '{\"ConfigurationType\": \"CENTRAL\"}'\n\n# Enable cross-region aggregation\naws securityhub create-finding-aggregator \\\n  --region-linking-mode ALL_REGIONS\n```\n\n### Step 3: Integrate Security Services and Third-Party Tools\n\nConfigure product integrations to receive findings from AWS services and partner security tools. Map third-party findings to AWS Security Finding Format (ASFF).\n\n```bash\n# List available product integrations\naws securityhub describe-products \\\n  --query 'Products[*].[ProductName,CompanyName,ProductSubscriptionResourcePolicy]' --output table\n\n# Enable specific integrations\naws securityhub enable-import-findings-for-product \\\n  --product-arn \"arn:aws:securityhub:us-east-1::product\u002Faws\u002Fguardduty\"\n\naws securityhub enable-import-findings-for-product \\\n  --product-arn \"arn:aws:securityhub:us-east-1::product\u002Faws\u002Finspector\"\n\n# Import custom findings using ASFF format\naws securityhub batch-import-findings --findings '[{\n  \"SchemaVersion\": \"2018-10-08\",\n  \"Id\": \"custom-finding-001\",\n  \"ProductArn\": \"arn:aws:securityhub:us-east-1:123456789012:product\u002F123456789012\u002Fdefault\",\n  \"GeneratorId\": \"custom-scanner\",\n  \"AwsAccountId\": \"123456789012\",\n  \"Types\": [\"Software and Configuration Checks\u002FVulnerabilities\u002FCVE\"],\n  \"Title\": \"Unpatched OpenSSL in production ALB backend\",\n  \"Description\": \"CVE-2024-12345 detected on backend instances\",\n  \"Severity\": {\"Label\": \"HIGH\"},\n  \"Resources\": [{\"Type\": \"AwsEc2Instance\", \"Id\": \"arn:aws:ec2:us-east-1:123456789012:instance\u002Fi-0abc123\"}]\n}]'\n```\n\n### Step 4: Build Automated Remediation\n\nCreate Security Hub custom actions linked to EventBridge rules and Lambda functions for one-click or fully automated remediation of common findings.\n\n```bash\n# Create a custom action for remediation\naws securityhub create-action-target \\\n  --name \"IsolateInstance\" \\\n  --description \"Isolate EC2 instance by replacing security groups\" \\\n  --id \"IsolateInstance\"\n\n# EventBridge rule for automated remediation of specific controls\naws events put-rule \\\n  --name SecurityHubAutoRemediate \\\n  --event-pattern '{\n    \"source\": [\"aws.securityhub\"],\n    \"detail-type\": [\"Security Hub Findings - Imported\"],\n    \"detail\": {\n      \"findings\": {\n        \"Compliance\": {\"Status\": [\"FAILED\"]},\n        \"Severity\": {\"Label\": [\"CRITICAL\", \"HIGH\"]},\n        \"GeneratorId\": [\"aws-foundational-security-best-practices\u002Fv\u002F1.0.0\u002FS3.1\"]\n      }\n    }\n  }'\n```\n\n### Step 5: Monitor Compliance Scores and Generate Reports\n\nTrack security scores across standards, monitor compliance drift over time, and generate reports for audit evidence.\n\n```bash\n# Get security score for a standard\naws securityhub get-security-control-definition \\\n  --security-control-id \"S3.1\"\n\n# List all failed controls with counts\naws securityhub get-findings \\\n  --filters '{\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --sort-criteria '{\"Field\": \"SeverityLabel\", \"SortOrder\": \"desc\"}' \\\n  --max-items 50\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Standard | Pre-packaged set of controls mapped to compliance frameworks such as CIS, PCI-DSS, NIST 800-53, and AWS best practices |\n| Security Control | Individual automated check that evaluates a specific AWS resource configuration against a security requirement |\n| ASFF | AWS Security Finding Format, a standardized JSON schema for normalizing findings from all integrated security products |\n| Compliance Score | Percentage of controls in a passing state within a given security standard, calculated per account and aggregated at the organization level |\n| Finding Aggregator | Cross-region mechanism that consolidates findings from all enabled regions into a single administrator region |\n| Custom Action | User-defined action that can be triggered from the Security Hub console to invoke EventBridge rules for manual or automated response |\n\n## Tools & Systems\n\n- **AWS Security Hub CSPM**: Core platform for automated security posture checks and finding aggregation\n- **AWS Config**: Underlying configuration recorder that Security Hub relies on for resource evaluation\n- **Amazon EventBridge**: Event routing service for connecting Security Hub findings to automated remediation workflows\n- **AWS Systems Manager**: Automation documents that Security Hub can invoke for remediation of common misconfigurations\n- **AWS Audit Manager**: Generates audit-ready reports using Security Hub findings as evidence\n\n## Common Scenarios\n\n### Scenario: Failed CIS Controls Across 50 Accounts\n\n**Context**: An enterprise enables CIS AWS Foundations Benchmark v5.0 and discovers 340 failed controls across 50 accounts, primarily in IAM password policy, CloudTrail configuration, and VPC flow log enablement.\n\n**Approach**:\n1. Export all FAILED findings grouped by control ID to identify the most prevalent issues\n2. Prioritize Critical and High severity controls that affect the most accounts\n3. Create Systems Manager Automation documents for the top 10 recurring failures\n4. Deploy automated remediation via EventBridge for controls like S3.1 (block public access) and CloudTrail.1 (enable multi-region trail)\n5. Schedule weekly compliance score reviews and track improvement over a 90-day remediation window\n\n**Pitfalls**: Enabling automated remediation for all controls at once can break production workloads that legitimately require public S3 access or specific network configurations. Always test remediation in a staging account first.\n\n## Output Format\n\n```\nAWS Security Hub Compliance Report\n====================================\nOrganization: acme-corp\nAdministrator Account: 111122223333\nReport Date: 2025-02-23\nStandards Enabled: CIS v5.0, AWS FSBP v1.0, PCI DSS v3.2.1\n\nCOMPLIANCE SCORES:\n  CIS AWS Foundations Benchmark v5.0: 78%\n  AWS Foundational Security Best Practices: 85%\n  PCI DSS v3.2.1: 72%\n\nTOP FAILED CONTROLS (by account count):\n  [S3.1]   Block public access settings enabled      - 23\u002F50 accounts FAILED\n  [CT.1]   CloudTrail multi-region enabled            - 12\u002F50 accounts FAILED\n  [IAM.4]  Root account has no access keys            -  3\u002F50 accounts FAILED\n  [EC2.19] Security groups restrict unrestricted ports- 31\u002F50 accounts FAILED\n  [RDS.3]  RDS encryption at rest enabled             - 18\u002F50 accounts FAILED\n\nFINDING SUMMARY:\n  Total Active Findings: 1,247\n  Critical: 34 | High: 189 | Medium: 567 | Low: 457\n  Auto-Remediated This Month: 89\n  Suppressed: 23\n```\n","# Implementing AWS Security Hub\n\n## When to Use\n\n- When establishing a centralized security findings dashboard across multiple AWS accounts\n- When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices\n- When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools\n- When building automated remediation workflows for recurring security misconfigurations\n- When preparing compliance evidence for auditors requiring continuous posture monitoring\n\n**Do not use** for real-time threat detection (see detecting-cloud-threats-with-guardduty), for Azure compliance monitoring (see securing-azure-with-microsoft-defender), or for deep vulnerability scanning of container images (see securing-container-registry).\n\n## Prerequisites\n\n- AWS Organization with a designated security administrator account\n- AWS Config enabled in all target accounts and regions\n- GuardDuty, Inspector, and Macie activated for finding integration\n- IAM permissions for securityhub:* and config:* in the administrator account\n\n## Workflow\n\n### Step 1: Enable Security Hub with Standards\n\nActivate Security Hub in the delegated administrator account and enable security standards. AWS Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53.\n\n```bash\n# Enable Security Hub with standards\naws securityhub enable-security-hub \\\n  --enable-default-standards \\\n  --tags '{\"Environment\":\"production\",\"ManagedBy\":\"security-team\"}'\n\n# Enable CIS AWS Foundations Benchmark v5.0\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests '[\n    {\"StandardsArn\": \"arn:aws:securityhub:::ruleset\u002Fcis-aws-foundations-benchmark\u002Fv\u002F5.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Faws-foundational-security-best-practices\u002Fv\u002F1.0.0\"},\n    {\"StandardsArn\": \"arn:aws:securityhub:us-east-1::standards\u002Fpci-dss\u002Fv\u002F3.2.1\"}\n  ]'\n\n# Verify enabled standards\naws securityhub get-enabled-standards \\\n  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table\n```\n\n### Step 2: Configure Multi-Account Aggregation\n\nDesignate a Security Hub administrator and automatically enroll all organization member accounts. Configure cross-region aggregation to consolidate findings into a single region.\n\n```bash\n# Designate delegated admin\naws securityhub enable-organization-admin-account \\\n  --admin-account-id 111122223333\n\n# Auto-enable for all org members\naws securityhub update-organization-configuration \\\n  --auto-enable \\\n  --organization-configuration '{\"ConfigurationType\": \"CENTRAL\"}'\n\n# Enable cross-region aggregation\naws securityhub create-finding-aggregator \\\n  --region-linking-mode ALL_REGIONS\n```\n\n### Step 3: Integrate Security Services and Third-Party Tools\n\nConfigure product integrations to receive findings from AWS services and partner security tools. Map third-party findings to AWS Security Finding Format (ASFF).\n\n```bash\n# List available product integrations\naws securityhub describe-products \\\n  --query 'Products[*].[ProductName,CompanyName,ProductSubscriptionResourcePolicy]' --output table\n\n# Enable specific integrations\naws securityhub enable-import-findings-for-product \\\n  --product-arn \"arn:aws:securityhub:us-east-1::product\u002Faws\u002Fguardduty\"\n\naws securityhub enable-import-findings-for-product \\\n  --product-arn \"arn:aws:securityhub:us-east-1::product\u002Faws\u002Finspector\"\n\n# Import custom findings using ASFF format\naws securityhub batch-import-findings --findings '[{\n  \"SchemaVersion\": \"2018-10-08\",\n  \"Id\": \"custom-finding-001\",\n  \"ProductArn\": \"arn:aws:securityhub:us-east-1:123456789012:product\u002F123456789012\u002Fdefault\",\n  \"GeneratorId\": \"custom-scanner\",\n  \"AwsAccountId\": \"123456789012\",\n  \"Types\": [\"Software and Configuration Checks\u002FVulnerabilities\u002FCVE\"],\n  \"Title\": \"Unpatched OpenSSL in production ALB backend\",\n  \"Description\": \"CVE-2024-12345 detected on backend instances\",\n  \"Severity\": {\"Label\": \"HIGH\"},\n  \"Resources\": [{\"Type\": \"AwsEc2Instance\", \"Id\": \"arn:aws:ec2:us-east-1:123456789012:instance\u002Fi-0abc123\"}]\n}]'\n```\n\n### Step 4: Build Automated Remediation\n\nCreate Security Hub custom actions linked to EventBridge rules and Lambda functions for one-click or fully automated remediation of common findings.\n\n```bash\n# Create a custom action for remediation\naws securityhub create-action-target \\\n  --name \"IsolateInstance\" \\\n  --description \"Isolate EC2 instance by replacing security groups\" \\\n  --id \"IsolateInstance\"\n\n# EventBridge rule for automated remediation of specific controls\naws events put-rule \\\n  --name SecurityHubAutoRemediate \\\n  --event-pattern '{\n    \"source\": [\"aws.securityhub\"],\n    \"detail-type\": [\"Security Hub Findings - Imported\"],\n    \"detail\": {\n      \"findings\": {\n        \"Compliance\": {\"Status\": [\"FAILED\"]},\n        \"Severity\": {\"Label\": [\"CRITICAL\", \"HIGH\"]},\n        \"GeneratorId\": [\"aws-foundational-security-best-practices\u002Fv\u002F1.0.0\u002FS3.1\"]\n      }\n    }\n  }'\n```\n\n### Step 5: Monitor Compliance Scores and Generate Reports\n\nTrack security scores across standards, monitor compliance drift over time, and generate reports for audit evidence.\n\n```bash\n# Get security score for a standard\naws securityhub get-security-control-definition \\\n  --security-control-id \"S3.1\"\n\n# List all failed controls with counts\naws securityhub get-findings \\\n  --filters '{\n    \"ComplianceStatus\": [{\"Value\": \"FAILED\", \"Comparison\": \"EQUALS\"}],\n    \"RecordState\": [{\"Value\": \"ACTIVE\", \"Comparison\": \"EQUALS\"}]\n  }' \\\n  --sort-criteria '{\"Field\": \"SeverityLabel\", \"SortOrder\": \"desc\"}' \\\n  --max-items 50\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Standard | Pre-packaged set of controls mapped to compliance frameworks such as CIS, PCI-DSS, NIST 800-53, and AWS best practices |\n| Security Control | Individual automated check that evaluates a specific AWS resource configuration against a security requirement |\n| ASFF | AWS Security Finding Format, a standardized JSON schema for normalizing findings from all integrated security products |\n| Compliance Score | Percentage of controls in a passing state within a given security standard, calculated per account and aggregated at the organization level |\n| Finding Aggregator | Cross-region mechanism that consolidates findings from all enabled regions into a single administrator region |\n| Custom Action | User-defined action that can be triggered from the Security Hub console to invoke EventBridge rules for manual or automated response |\n\n## Tools & Systems\n\n- **AWS Security Hub CSPM**: Core platform for automated security posture checks and finding aggregation\n- **AWS Config**: Underlying configuration recorder that Security Hub relies on for resource evaluation\n- **Amazon EventBridge**: Event routing service for connecting Security Hub findings to automated remediation workflows\n- **AWS Systems Manager**: Automation documents that Security Hub can invoke for remediation of common misconfigurations\n- **AWS Audit Manager**: Generates audit-ready reports using Security Hub findings as evidence\n\n## Common Scenarios\n\n### Scenario: Failed CIS Controls Across 50 Accounts\n\n**Context**: An enterprise enables CIS AWS Foundations Benchmark v5.0 and discovers 340 failed controls across 50 accounts, primarily in IAM password policy, CloudTrail configuration, and VPC flow log enablement.\n\n**Approach**:\n1. Export all FAILED findings grouped by control ID to identify the most prevalent issues\n2. Prioritize Critical and High severity controls that affect the most accounts\n3. Create Systems Manager Automation documents for the top 10 recurring failures\n4. Deploy automated remediation via EventBridge for controls like S3.1 (block public access) and CloudTrail.1 (enable multi-region trail)\n5. Schedule weekly compliance score reviews and track improvement over a 90-day remediation window\n\n**Pitfalls**: Enabling automated remediation for all controls at once can break production workloads that legitimately require public S3 access or specific network configurations. Always test remediation in a staging account first.\n\n## Output Format\n\n```\nAWS Security Hub Compliance Report\n====================================\nOrganization: acme-corp\nAdministrator Account: 111122223333\nReport Date: 2025-02-23\nStandards Enabled: CIS v5.0, AWS FSBP v1.0, PCI DSS v3.2.1\n\nCOMPLIANCE SCORES:\n  CIS AWS Foundations Benchmark v5.0: 78%\n  AWS Foundational Security Best Practices: 85%\n  PCI DSS v3.2.1: 72%\n\nTOP FAILED CONTROLS (by account count):\n  [S3.1]   Block public access settings enabled      - 23\u002F50 accounts FAILED\n  [CT.1]   CloudTrail multi-region enabled            - 12\u002F50 accounts FAILED\n  [IAM.4]  Root account has no access keys            -  3\u002F50 accounts FAILED\n  [EC2.19] Security groups restrict unrestricted ports- 31\u002F50 accounts FAILED\n  [RDS.3]  RDS encryption at rest enabled             - 18\u002F50 accounts FAILED\n\nFINDING SUMMARY:\n  Total Active Findings: 1,247\n  Critical: 34 | High: 189 | Medium: 567 | Low: 457\n  Auto-Remediated This Month: 89\n  Suppressed: 23\n```\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":44,"description":62,"mitre_attack":63},[36,37,35,34,33],"mahipal","1.0.0",[58,59,60,61],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge\u002FSystems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.\n",[64,65,66,67],"T1078.004","T1530","T1537","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-aws-security-hub",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-aws-security-hub","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub\u002FSKILL.md",true,[92,97,103,107,111,115,119,123,129,133],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",2354,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fevents.md",8579,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Freferences\u002Fevents.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fmonitoring.md",12923,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Freferences\u002Fmonitoring.md",{"path":112,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fprocess-interaction.md",11525,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Freferences\u002Fprocess-interaction.md",{"path":116,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Freal-time.md",10728,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Freferences\u002Freal-time.md",{"path":120,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fresources.md",7327,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Freferences\u002Fresources.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",6933,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-aws-security-hub\u002Fscripts\u002Fagent.py",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fbasic_simulation_template.py",5558,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Fscripts\u002Fbasic_simulation_template.py",{"path":134,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fresource_monitor.py",11680,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fsimpy\u002Fscripts\u002Fresource_monitor.py",[138,164,188,215,241,267],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,31,48,150,151,152,153,154,155,156,157,158,159,160,161,162,163],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":171,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[170],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,160,173,174,31,175,48,152,176,177,178,179,180,181,182,183,184,185,186,187],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":198,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[194,197],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[182,199,200,201,202,48,203,204,176,205,206,207,208,209,210,39,211,212,213,214],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[221],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[223,224,225,48,226,227,228,229,230,231,232,233,234,235,236,237,179,238,239,240],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":248,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[247],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[249,250,251,48,252,253,254,255,256,257,258,259,260,42,261,262,263,264,265,266],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":268,"name":269,"nameZh":6,"description":270,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":271,"categories":272,"keywords":274,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[273],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[31,275,48,276,277,278,279,280,43,281,282,39,283,211,284,285,286,287,288,289],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]