[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF0XEWDGAJ4HANFHE909MK":3,"skill-same:01M6AF0XEWDGAJ4HANFHE909MK":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AF0XEWDGAJ4HANFHE909MK","implementing-beyondcorp-zero-trust-access-model",null,"Implement Google's BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for VPN-less application access. Use for replacing VPN, enforcing device posture checks, or securing remote\u002Fhybrid access to GCP-hosted or on-prem apps; not for raw network-level protocols.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing beyondcorp zero trust access model","ZeRO","gcp","iap","beyondcorp","t1078","identity-aware","endpoint","vpn-less","ztna","zero-trust","google","network","proxy","protocols","verification","pr","identity","architecture","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-beyondcorp-zero-trust-access-model\ndescription: 'Implement Google''s BeyondCorp zero trust access model using Cloud\n  IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and\n  BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for\n  VPN-less application access. Use for replacing VPN, enforcing device posture checks,\n  or securing remote\u002Fhybrid access to GCP-hosted or on-prem apps; not for raw network-level\n  protocols.\n\n  '\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- beyondcorp\n- zero-trust\n- google-cloud\n- iap\n- identity-aware-proxy\n- ztna\n- access-context-manager\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1078.004\n- T1530\n---\n\n# Implementing BeyondCorp Zero Trust Access Model\n\n## When to Use\n\n- When replacing traditional VPN infrastructure with identity-based application access\n- When migrating to Google Cloud and requiring zero trust access for internal applications\n- When implementing device trust verification as a prerequisite for resource access\n- When needing context-aware access policies based on user identity, device posture, and location\n- When securing access for remote and hybrid workforce without network-level trust\n\n**Do not use** when applications require raw network-level access (e.g., UDP-based protocols not supported by IAP), for consumer-facing public applications, or when the organization lacks an identity provider with MFA capabilities.\n\n## Prerequisites\n\n- Google Cloud organization with Cloud Identity or Google Workspace\n- Identity-Aware Proxy (IAP) API enabled on the GCP project\n- Chrome Enterprise Premium license for endpoint verification\n- Applications deployed behind a Google Cloud Load Balancer or on App Engine\u002FCloud Run\n- Endpoint Verification extension deployed on all corporate devices\n- Access Context Manager API enabled\n\n## Workflow\n\n### Step 1: Configure Access Context Manager with Access Levels\n\nDefine access levels that represent trust tiers based on device and user attributes.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\ngcloud services enable beyondcorp.googleapis.com\n\n# Create an access policy (organization level)\ngcloud access-context-manager policies create \\\n  --organization=ORG_ID \\\n  --title=\"BeyondCorp Enterprise Policy\"\n\n# Create a basic access level for corporate managed devices\ncat > corporate-device-level.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_CHROME_OS\n        minimumVersion: \"13816.0.0\"\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"13.0.0\"\n    requireScreenlock: true\n    requireAdminApproval: true\n  regions:\n    - US\n    - GB\n    - DE\nEOF\n\ngcloud access-context-manager levels create corporate-managed \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Managed Device\" \\\n  --basic-level-spec=corporate-device-level.yaml\n\n# Create a custom access level using CEL expressions\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust Level\" \\\n  --custom-level-spec=high-trust-cel.yaml\n```\n\n### Step 2: Deploy Identity-Aware Proxy on Applications\n\nEnable IAP on backend services to enforce identity verification before granting access.\n\n```bash\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Corporate Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client for IAP\ngcloud iap oauth-clients create BRAND_NAME \\\n  --display_name=\"BeyondCorp IAP Client\"\n\n# Enable IAP on a backend service (GCE\u002FGKE behind HTTPS LB)\ngcloud compute backend-services update internal-app-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# Enable IAP on App Engine\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# Enable IAP on Cloud Run service\ngcloud run services add-iam-policy-binding internal-api \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n```\n\n### Step 3: Configure IAM Bindings with Access Level Conditions\n\nBind IAP access to specific groups with access level requirements.\n\n```bash\n# Grant access to engineering group with corporate device requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-managed,title=Require Corporate Device\"\n\n# Grant access to contractors with high-trust requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:contractors@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fhigh-trust,title=Require High Trust\"\n\n# Configure re-authentication settings (session duration)\ngcloud iap settings set --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=internal-app-backend \\\n  --reauth-method=LOGIN \\\n  --max-session-duration=3600s\n```\n\n### Step 4: Deploy Endpoint Verification on Corporate Devices\n\nRoll out Chrome Enterprise Endpoint Verification for device posture collection.\n\n```bash\n# Deploy Endpoint Verification via Chrome policy (managed browsers)\n# In Google Admin Console > Devices > Chrome > Apps & extensions\n# Force-install: Endpoint Verification extension ID: callobklhcbilhphinckomhgkigmfocg\n\n# Verify device inventory in Admin SDK\ngcloud endpoint-verification list-endpoints \\\n  --filter=\"deviceType=CHROME_BROWSER\" \\\n  --format=\"table(deviceId, osVersion, isCompliant, encryptionStatus)\"\n\n# Create device trust connector for third-party EDR signals\ngcloud beyondcorp app connections create crowdstrike-connector \\\n  --project=PROJECT_ID \\\n  --location=global \\\n  --application-endpoint=host=crowdstrike-api.internal:443,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fconnector-1\n\n# List enrolled devices and their compliance status\ngcloud alpha devices list --format=\"table(name,deviceType,complianceState)\"\n```\n\n### Step 5: Implement BeyondCorp Enterprise Threat Protection\n\nEnable URL filtering, malware scanning, and DLP for Chrome Enterprise users.\n\n```bash\n# Configure Chrome Enterprise Premium threat protection rules\n# In Google Admin Console > Security > Chrome Enterprise Premium\n\n# Create a BeyondCorp Enterprise connector for on-prem apps\ngcloud beyondcorp app connectors create onprem-connector \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --display-name=\"On-Premises App Connector\"\n\ngcloud beyondcorp app connections create hr-portal \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --application-endpoint=host=hr.internal.company.com,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fonprem-connector\n\n# Enable security investigation tool for access anomaly detection\ngcloud logging read '\n  resource.type=\"iap_tunnel\"\n  jsonPayload.decision=\"DENY\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format=json --limit=100\n```\n\n### Step 6: Monitor and Audit BeyondCorp Access Decisions\n\nSet up comprehensive logging and alerting for zero trust policy enforcement.\n\n```bash\n# Create a log sink for IAP access decisions\ngcloud logging sinks create iap-access-audit \\\n  --destination=bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Fbeyondcorp_audit \\\n  --log-filter='resource.type=\"iap_tunnel\" OR resource.type=\"gce_backend_service\"'\n\n# Query BigQuery for access pattern analysis\nbq query --use_legacy_sql=false '\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS user,\n  resource.labels.backend_service_name AS application,\n  JSON_EXTRACT_SCALAR(protopayload_auditlog.requestMetadata.callerSuppliedUserAgent, \"$\") AS device,\n  protopayload_auditlog.status.code AS decision_code,\n  COUNT(*) AS request_count\nFROM `PROJECT_ID.beyondcorp_audit.cloudaudit_googleapis_com_data_access`\nWHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)\nGROUP BY user, application, device, decision_code\nORDER BY request_count DESC\nLIMIT 50\n'\n\n# Create an alert policy for repeated access denials\ngcloud alpha monitoring policies create \\\n  --display-name=\"BeyondCorp Repeated Access Denials\" \\\n  --condition-display-name=\"High denial rate\" \\\n  --condition-filter='resource.type=\"iap_tunnel\" AND jsonPayload.decision=\"DENY\"' \\\n  --condition-threshold-value=10 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BeyondCorp | Google's zero trust security framework that shifts access controls from network perimeter to per-request identity and device verification |\n| Identity-Aware Proxy (IAP) | Google Cloud service that intercepts HTTP requests and verifies user identity and device context before forwarding to backend applications |\n| Access Context Manager | GCP service that defines fine-grained attribute-based access control policies using access levels and service perimeters |\n| Endpoint Verification | Chrome Enterprise extension that collects device attributes (OS version, encryption, screen lock) for access level evaluation |\n| Access Levels | Named conditions in Access Context Manager that define minimum requirements (device posture, IP range, geography) for resource access |\n| Chrome Enterprise Premium | Google's commercial BeyondCorp offering providing threat protection, URL filtering, DLP, and continuous access evaluation |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy enforcing per-request authentication and authorization for GCP-hosted applications\n- **Access Context Manager**: Policy engine defining access levels based on device attributes, IP ranges, and geographic locations\n- **Chrome Enterprise Premium**: Extended BeyondCorp capabilities including real-time threat protection and data loss prevention\n- **Endpoint Verification**: Device posture collection agent deployed as Chrome extension to all corporate endpoints\n- **BeyondCorp Enterprise Connectors**: Secure tunnel connectors enabling IAP protection for on-premises applications\n- **Cloud Audit Logs**: Immutable log records of all IAP access decisions for compliance and forensic analysis\n\n## Common Scenarios\n\n### Scenario: Migrating 50+ Internal Applications from VPN to BeyondCorp\n\n**Context**: A technology company with 3,000 employees uses Cisco AnyConnect VPN for accessing internal applications. The VPN introduces latency, creates a single point of failure, and grants excessive network access after authentication.\n\n**Approach**:\n1. Inventory all 50+ applications and categorize by hosting (GCP, on-prem, SaaS) and protocol (HTTPS, TCP, SSH)\n2. Deploy Endpoint Verification to all corporate devices and establish baseline device posture data over 2 weeks\n3. Create access levels in Access Context Manager: corporate-managed, contractor-device, high-trust\n4. Enable IAP on GCP-hosted HTTPS applications first (App Engine, Cloud Run, GKE services)\n5. Deploy BeyondCorp Enterprise connectors for on-premises applications\n6. Migrate users in 3 phases: IT\u002FEngineering (week 1-2), General staff (week 3-4), Executives\u002FFinance (week 5-6)\n7. Configure re-authentication policies: 8 hours for general apps, 1 hour for financial systems\n8. Set up BigQuery audit pipeline for continuous monitoring and anomaly detection\n9. Decommission VPN after 30-day parallel operation period\n\n**Pitfalls**: Some legacy applications may not support HTTPS proxying and require TCP tunnel mode. Device enrollment takes time; plan a 2-week onboarding period before enforcing device posture requirements. Break-glass accounts with bypassed access levels must be created and tested for identity provider outages.\n\n## Output Format\n\n```\nBeyondCorp Zero Trust Implementation Report\n==================================================\nOrganization: TechCorp Inc.\nImplementation Date: 2026-02-23\nMigration Phase: Phase 2 of 3\n\nACCESS ARCHITECTURE:\n  Identity Provider: Google Workspace\n  Access Proxy: Google Cloud IAP\n  Device Management: Chrome Enterprise + Endpoint Verification\n  Threat Protection: Chrome Enterprise Premium\n  On-Prem Connector: BeyondCorp Enterprise Connector (3 instances)\n\nACCESS LEVEL COVERAGE:\n  Access Level: corporate-managed\n    Devices enrolled:              2,847 \u002F 3,000 (94.9%)\n    Compliant devices:             2,712 \u002F 2,847 (95.3%)\n  Access Level: high-trust\n    Devices enrolled:              312 \u002F 350 (89.1%)\n    Compliant devices:             298 \u002F 312 (95.5%)\n\nAPPLICATION MIGRATION:\n  GCP HTTPS apps (IAP-protected):  32 \u002F 35 (91.4%)\n  On-prem apps (via connector):    12 \u002F 15 (80.0%)\n  SaaS apps (via SAML\u002FOIDC):       8 \u002F 8 (100%)\n  Total migrated:                  52 \u002F 58 (89.7%)\n\nSECURITY METRICS (last 30 days):\n  Total access requests:           1,247,832\n  Denied by IAP policy:            3,412 (0.27%)\n  Denied by access level:          1,208 (0.10%)\n  Re-authentication triggered:     45,219\n  Anomalous access patterns:       12 (investigated)\n  VPN-related incidents (before):  8\u002Fmonth\n  BeyondCorp incidents (after):    1\u002Fmonth\n\nVPN DECOMMISSION STATUS:\n  Parallel operation remaining:    14 days\n  Users still on VPN:              148 (5%)\n  Planned decommission:            2026-03-15\n```\n","# Implementing BeyondCorp Zero Trust Access Model\n\n## When to Use\n\n- When replacing traditional VPN infrastructure with identity-based application access\n- When migrating to Google Cloud and requiring zero trust access for internal applications\n- When implementing device trust verification as a prerequisite for resource access\n- When needing context-aware access policies based on user identity, device posture, and location\n- When securing access for remote and hybrid workforce without network-level trust\n\n**Do not use** when applications require raw network-level access (e.g., UDP-based protocols not supported by IAP), for consumer-facing public applications, or when the organization lacks an identity provider with MFA capabilities.\n\n## Prerequisites\n\n- Google Cloud organization with Cloud Identity or Google Workspace\n- Identity-Aware Proxy (IAP) API enabled on the GCP project\n- Chrome Enterprise Premium license for endpoint verification\n- Applications deployed behind a Google Cloud Load Balancer or on App Engine\u002FCloud Run\n- Endpoint Verification extension deployed on all corporate devices\n- Access Context Manager API enabled\n\n## Workflow\n\n### Step 1: Configure Access Context Manager with Access Levels\n\nDefine access levels that represent trust tiers based on device and user attributes.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\ngcloud services enable beyondcorp.googleapis.com\n\n# Create an access policy (organization level)\ngcloud access-context-manager policies create \\\n  --organization=ORG_ID \\\n  --title=\"BeyondCorp Enterprise Policy\"\n\n# Create a basic access level for corporate managed devices\ncat > corporate-device-level.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_CHROME_OS\n        minimumVersion: \"13816.0.0\"\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"13.0.0\"\n    requireScreenlock: true\n    requireAdminApproval: true\n  regions:\n    - US\n    - GB\n    - DE\nEOF\n\ngcloud access-context-manager levels create corporate-managed \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Managed Device\" \\\n  --basic-level-spec=corporate-device-level.yaml\n\n# Create a custom access level using CEL expressions\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust Level\" \\\n  --custom-level-spec=high-trust-cel.yaml\n```\n\n### Step 2: Deploy Identity-Aware Proxy on Applications\n\nEnable IAP on backend services to enforce identity verification before granting access.\n\n```bash\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Corporate Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client for IAP\ngcloud iap oauth-clients create BRAND_NAME \\\n  --display_name=\"BeyondCorp IAP Client\"\n\n# Enable IAP on a backend service (GCE\u002FGKE behind HTTPS LB)\ngcloud compute backend-services update internal-app-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# Enable IAP on App Engine\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# Enable IAP on Cloud Run service\ngcloud run services add-iam-policy-binding internal-api \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n```\n\n### Step 3: Configure IAM Bindings with Access Level Conditions\n\nBind IAP access to specific groups with access level requirements.\n\n```bash\n# Grant access to engineering group with corporate device requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-managed,title=Require Corporate Device\"\n\n# Grant access to contractors with high-trust requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:contractors@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fhigh-trust,title=Require High Trust\"\n\n# Configure re-authentication settings (session duration)\ngcloud iap settings set --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=internal-app-backend \\\n  --reauth-method=LOGIN \\\n  --max-session-duration=3600s\n```\n\n### Step 4: Deploy Endpoint Verification on Corporate Devices\n\nRoll out Chrome Enterprise Endpoint Verification for device posture collection.\n\n```bash\n# Deploy Endpoint Verification via Chrome policy (managed browsers)\n# In Google Admin Console > Devices > Chrome > Apps & extensions\n# Force-install: Endpoint Verification extension ID: callobklhcbilhphinckomhgkigmfocg\n\n# Verify device inventory in Admin SDK\ngcloud endpoint-verification list-endpoints \\\n  --filter=\"deviceType=CHROME_BROWSER\" \\\n  --format=\"table(deviceId, osVersion, isCompliant, encryptionStatus)\"\n\n# Create device trust connector for third-party EDR signals\ngcloud beyondcorp app connections create crowdstrike-connector \\\n  --project=PROJECT_ID \\\n  --location=global \\\n  --application-endpoint=host=crowdstrike-api.internal:443,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fconnector-1\n\n# List enrolled devices and their compliance status\ngcloud alpha devices list --format=\"table(name,deviceType,complianceState)\"\n```\n\n### Step 5: Implement BeyondCorp Enterprise Threat Protection\n\nEnable URL filtering, malware scanning, and DLP for Chrome Enterprise users.\n\n```bash\n# Configure Chrome Enterprise Premium threat protection rules\n# In Google Admin Console > Security > Chrome Enterprise Premium\n\n# Create a BeyondCorp Enterprise connector for on-prem apps\ngcloud beyondcorp app connectors create onprem-connector \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --display-name=\"On-Premises App Connector\"\n\ngcloud beyondcorp app connections create hr-portal \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --application-endpoint=host=hr.internal.company.com,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fonprem-connector\n\n# Enable security investigation tool for access anomaly detection\ngcloud logging read '\n  resource.type=\"iap_tunnel\"\n  jsonPayload.decision=\"DENY\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format=json --limit=100\n```\n\n### Step 6: Monitor and Audit BeyondCorp Access Decisions\n\nSet up comprehensive logging and alerting for zero trust policy enforcement.\n\n```bash\n# Create a log sink for IAP access decisions\ngcloud logging sinks create iap-access-audit \\\n  --destination=bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Fbeyondcorp_audit \\\n  --log-filter='resource.type=\"iap_tunnel\" OR resource.type=\"gce_backend_service\"'\n\n# Query BigQuery for access pattern analysis\nbq query --use_legacy_sql=false '\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS user,\n  resource.labels.backend_service_name AS application,\n  JSON_EXTRACT_SCALAR(protopayload_auditlog.requestMetadata.callerSuppliedUserAgent, \"$\") AS device,\n  protopayload_auditlog.status.code AS decision_code,\n  COUNT(*) AS request_count\nFROM `PROJECT_ID.beyondcorp_audit.cloudaudit_googleapis_com_data_access`\nWHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)\nGROUP BY user, application, device, decision_code\nORDER BY request_count DESC\nLIMIT 50\n'\n\n# Create an alert policy for repeated access denials\ngcloud alpha monitoring policies create \\\n  --display-name=\"BeyondCorp Repeated Access Denials\" \\\n  --condition-display-name=\"High denial rate\" \\\n  --condition-filter='resource.type=\"iap_tunnel\" AND jsonPayload.decision=\"DENY\"' \\\n  --condition-threshold-value=10 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BeyondCorp | Google's zero trust security framework that shifts access controls from network perimeter to per-request identity and device verification |\n| Identity-Aware Proxy (IAP) | Google Cloud service that intercepts HTTP requests and verifies user identity and device context before forwarding to backend applications |\n| Access Context Manager | GCP service that defines fine-grained attribute-based access control policies using access levels and service perimeters |\n| Endpoint Verification | Chrome Enterprise extension that collects device attributes (OS version, encryption, screen lock) for access level evaluation |\n| Access Levels | Named conditions in Access Context Manager that define minimum requirements (device posture, IP range, geography) for resource access |\n| Chrome Enterprise Premium | Google's commercial BeyondCorp offering providing threat protection, URL filtering, DLP, and continuous access evaluation |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy enforcing per-request authentication and authorization for GCP-hosted applications\n- **Access Context Manager**: Policy engine defining access levels based on device attributes, IP ranges, and geographic locations\n- **Chrome Enterprise Premium**: Extended BeyondCorp capabilities including real-time threat protection and data loss prevention\n- **Endpoint Verification**: Device posture collection agent deployed as Chrome extension to all corporate endpoints\n- **BeyondCorp Enterprise Connectors**: Secure tunnel connectors enabling IAP protection for on-premises applications\n- **Cloud Audit Logs**: Immutable log records of all IAP access decisions for compliance and forensic analysis\n\n## Common Scenarios\n\n### Scenario: Migrating 50+ Internal Applications from VPN to BeyondCorp\n\n**Context**: A technology company with 3,000 employees uses Cisco AnyConnect VPN for accessing internal applications. The VPN introduces latency, creates a single point of failure, and grants excessive network access after authentication.\n\n**Approach**:\n1. Inventory all 50+ applications and categorize by hosting (GCP, on-prem, SaaS) and protocol (HTTPS, TCP, SSH)\n2. Deploy Endpoint Verification to all corporate devices and establish baseline device posture data over 2 weeks\n3. Create access levels in Access Context Manager: corporate-managed, contractor-device, high-trust\n4. Enable IAP on GCP-hosted HTTPS applications first (App Engine, Cloud Run, GKE services)\n5. Deploy BeyondCorp Enterprise connectors for on-premises applications\n6. Migrate users in 3 phases: IT\u002FEngineering (week 1-2), General staff (week 3-4), Executives\u002FFinance (week 5-6)\n7. Configure re-authentication policies: 8 hours for general apps, 1 hour for financial systems\n8. Set up BigQuery audit pipeline for continuous monitoring and anomaly detection\n9. Decommission VPN after 30-day parallel operation period\n\n**Pitfalls**: Some legacy applications may not support HTTPS proxying and require TCP tunnel mode. Device enrollment takes time; plan a 2-week onboarding period before enforcing device posture requirements. Break-glass accounts with bypassed access levels must be created and tested for identity provider outages.\n\n## Output Format\n\n```\nBeyondCorp Zero Trust Implementation Report\n==================================================\nOrganization: TechCorp Inc.\nImplementation Date: 2026-02-23\nMigration Phase: Phase 2 of 3\n\nACCESS ARCHITECTURE:\n  Identity Provider: Google Workspace\n  Access Proxy: Google Cloud IAP\n  Device Management: Chrome Enterprise + Endpoint Verification\n  Threat Protection: Chrome Enterprise Premium\n  On-Prem Connector: BeyondCorp Enterprise Connector (3 instances)\n\nACCESS LEVEL COVERAGE:\n  Access Level: corporate-managed\n    Devices enrolled:              2,847 \u002F 3,000 (94.9%)\n    Compliant devices:             2,712 \u002F 2,847 (95.3%)\n  Access Level: high-trust\n    Devices enrolled:              312 \u002F 350 (89.1%)\n    Compliant devices:             298 \u002F 312 (95.5%)\n\nAPPLICATION MIGRATION:\n  GCP HTTPS apps (IAP-protected):  32 \u002F 35 (91.4%)\n  On-prem apps (via connector):    12 \u002F 15 (80.0%)\n  SaaS apps (via SAML\u002FOIDC):       8 \u002F 8 (100%)\n  Total migrated:                  52 \u002F 58 (89.7%)\n\nSECURITY METRICS (last 30 days):\n  Total access requests:           1,247,832\n  Denied by IAP policy:            3,412 (0.27%)\n  Denied by access level:          1,208 (0.10%)\n  Re-authentication triggered:     45,219\n  Anomalous access patterns:       12 (investigated)\n  VPN-related incidents (before):  8\u002Fmonth\n  BeyondCorp incidents (after):    1\u002Fmonth\n\nVPN DECOMMISSION STATUS:\n  Parallel operation remaining:    14 days\n  Users still on VPN:              148 (5%)\n  Planned decommission:            2026-03-15\n```\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":60,"description":61,"mitre_attack":62},[28,34,50,27,51,33,52],"google-cloud","identity-aware-proxy","access-context-manager","mahipal","1.0",[56,57,58,59],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","Implement Google's BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for VPN-less application access. Use for replacing VPN, enforcing device posture checks, or securing remote\u002Fhybrid access to GCP-hosted or on-prem apps; not for raw network-level protocols.\n",[63,64,65,66,67],"T1078","T1190","T1059","T1078.004","T1530","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-beyondcorp-zero-trust-access-model",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-beyondcorp-zero-trust-access-model",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-beyondcorp-zero-trust-access-model",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-beyondcorp-zero-trust-access-model","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002FSKILL.md",true,[92,98,104,108,114,120,125,129,133,137,141,145,149],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"anthropic-best-practices.md","REFERENCE","参考文档",45825,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fanthropic-best-practices.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"assets\u002Ftemplate.md","ASSET","资产文件",4929,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Fassets\u002Ftemplate.md",{"path":105,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":106,"sourceHtmlUrl":107},"examples\u002FCLAUDE_MD_TESTING.md",5423,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fexamples\u002FCLAUDE_MD_TESTING.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"executable_render-graphs.js","SCRIPT","脚本",4857,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fexecutable_render-graphs.js",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"graphviz-conventions.dot","OTHER","其他",5970,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fgraphviz-conventions.dot",{"path":121,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002FLICENSE",{"path":126,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":127,"sourceHtmlUrl":128},"persuasion-principles.md",5908,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fpersuasion-principles.md",{"path":130,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fapi-reference.md",1633,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Freferences\u002Fapi-reference.md",{"path":134,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fstandards.md",2762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Freferences\u002Fstandards.md",{"path":138,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":139,"sourceHtmlUrl":140},"references\u002Fworkflows.md",5100,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Freferences\u002Fworkflows.md",{"path":142,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Fagent.py",4902,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Fscripts\u002Fagent.py",{"path":146,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fprocess.py",14683,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-beyondcorp-zero-trust-access-model\u002Fscripts\u002Fprocess.py",{"path":150,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":151,"sourceHtmlUrl":152},"testing-skills-with-subagents.md",12557,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Ftesting-skills-with-subagents.md",[154,179,201,228,254,281],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,163,164,165,166,43,167,41,40,168,169,170,171,172,173,174,175,176,177,178],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,175,188,189,166,190,43,40,39,25,191,192,193,194,195,196,197,198,199,200],"boot","TPM","validating tpm measured boot attestation","policy","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":211,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[207,210],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,212,213,214,215,43,216,217,39,218,219,220,221,222,223,29,224,225,226,227],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,43,239,240,241,242,243,244,245,246,247,248,249,250,192,251,252,253],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[260],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[262,263,264,43,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":282,"name":283,"nameZh":6,"description":284,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":285,"categories":286,"keywords":288,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[287],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,289,43,290,291,292,293,294,295,296,297,29,298,224,299,300,301,302,303,304],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]