[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF167WCY24A2JF2C219EMW":3,"skill-same:01M6AF167WCY24A2JF2C219EMW":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":95,"commitSha":96,"skillDirectory":97,"forksCount":98,"repositoryHtmlUrl":99,"repositoryHomepageUrl":100,"ownerHtmlUrl":101,"ownerBlogUrl":102,"ownerDescription":103,"updatedAt":104,"install":105,"resources":118},"01M6AF167WCY24A2JF2C219EMW","implementing-browser-isolation-for-zero-trust",null,"Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-browser-isolation-for-zero-trust\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing browser isolation for zero trust","browser","ZeRO","network","prevention","initial-access","injection","t1003","zscaler","ztna","zero-trust","data","malicious","exfiltration","cloudflare","secure","architecture","component","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-browser-isolation-for-zero-trust\ndescription: 'Deploys remote browser isolation (RBI) as a core component of a Zero\n  Trust architecture. Implements isolation policies with URL categorization and risk-based\n  routing, content disarming and reconstruction (CDR) for file sanitization, data\n  loss prevention controls within isolated sessions, and integration with Secure Web\n  Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security,\n  and Zscaler RBI approaches. Use when hardening web access against zero-day exploits,\n  phishing, credential theft, and browser-based data exfiltration.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- browser-isolation\n- zero-trust\n- RBI\n- CDR\n- URL-categorization\n- content-disarming\n- secure-web-gateway\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - execution\n  techniques:\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1557\n    name: Adversary-in-the-Middle\n    tactic: positioning\n    source: attack\n  - id: T1185\n    name: Browser Session Hijacking\n    tactic: positioning\n    source: attack\n  - id: F1007\n    name: Adversary-in-the-Browser\n    tactic: positioning\n    source: f3\n  - id: F1007.002\n    name: 'Adversary-in-the-Browser: Malicious Browser Extension'\n    tactic: positioning\n    source: f3\n  - id: F1007.003\n    name: 'Adversary-in-the-Browser: Malicious JavaScript Injection'\n    tactic: execution\n    source: f3\n---\n\n# Implementing Browser Isolation for Zero Trust\n\n## When to Use\n\n- When deploying remote browser isolation as part of a Zero Trust security architecture\n- When protecting users from zero-day browser exploits and drive-by downloads\n- When implementing content disarming and reconstruction for file downloads\n- When enforcing data loss prevention policies for web browsing sessions\n- When securing access to untrusted or uncategorized websites\n- When integrating browser isolation with existing SWG and ZTNA infrastructure\n- When protecting against phishing and credential theft via isolated rendering\n\n## Prerequisites\n\n- Familiarity with Zero Trust architecture principles and network security\n- Understanding of Secure Web Gateway (SWG) and proxy deployment models\n- Access to a test or lab environment for policy validation\n- Python 3.8+ with required dependencies installed\n- DNS and proxy infrastructure for traffic routing\n\n## Instructions\n\n### Phase 1: URL Categorization and Risk Classification\n\nBuild a URL categorization engine that classifies websites by risk level to\ndetermine isolation policy. URLs are scored based on threat intelligence feeds,\ndomain reputation, content category, and historical risk indicators.\n\n```python\nfrom agent import BrowserIsolationPolicyEngine\n\nengine = BrowserIsolationPolicyEngine(\n    organization=\"Acme Corp\",\n    default_isolation_mode=\"isolate_risky\",\n)\n\n# Classify a URL and determine isolation action\nresult = engine.classify_url(\"https:\u002F\u002Fdocs.google.com\u002Fspreadsheets\u002Fd\u002Fabc123\")\nprint(f\"Category: {result['category']}\")\nprint(f\"Risk Level: {result['risk_level']}\")\nprint(f\"Isolation Action: {result['action']}\")\n# Output: Category: cloud_productivity\n#         Risk Level: low\n#         Action: allow_direct\n\nresult = engine.classify_url(\"https:\u002F\u002Funknown-sketchy-domain.xyz\u002Fdownload.html\")\nprint(f\"Category: {result['category']}\")\nprint(f\"Risk Level: {result['risk_level']}\")\nprint(f\"Isolation Action: {result['action']}\")\n# Output: Category: uncategorized\n#         Risk Level: high\n#         Action: full_isolation\n```\n\n### Phase 2: Isolation Policy Configuration\n\nDefine isolation policies that map URL categories and risk levels to specific\nisolation modes and DLP restrictions. Policies support granular controls including\nclipboard, file download, upload, and printing restrictions.\n\n```python\n# Configure isolation policies\nengine.add_isolation_policy(\n    name=\"Block Uncategorized Sites\",\n    description=\"Fully isolate all uncategorized or newly registered domains\",\n    match_criteria={\n        \"url_categories\": [\"uncategorized\", \"newly_registered\"],\n        \"risk_levels\": [\"high\", \"critical\"],\n    },\n    isolation_mode=\"full_isolation\",\n    dlp_controls={\n        \"disable_copy_paste\": True,\n        \"disable_download\": True,\n        \"disable_upload\": True,\n        \"disable_printing\": True,\n        \"disable_keyboard_input\": False,\n        \"watermark_session\": True,\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"Isolate Webmail with DLP\",\n    description=\"Isolate personal webmail with download restrictions\",\n    match_criteria={\n        \"url_categories\": [\"webmail\"],\n        \"domains\": [\"mail.google.com\", \"outlook.live.com\", \"mail.yahoo.com\"],\n    },\n    isolation_mode=\"read_only_isolation\",\n    dlp_controls={\n        \"disable_copy_paste\": True,\n        \"disable_download\": True,\n        \"disable_upload\": True,\n        \"disable_printing\": True,\n        \"disable_keyboard_input\": False,\n        \"watermark_session\": False,\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"CDR for File Downloads\",\n    description=\"Apply content disarm and reconstruction to all file downloads\",\n    match_criteria={\n        \"url_categories\": [\"*\"],\n        \"file_types\": [\"pdf\", \"docx\", \"xlsx\", \"pptx\", \"zip\", \"exe\", \"msi\"],\n    },\n    isolation_mode=\"cdr_passthrough\",\n    cdr_config={\n        \"strip_macros\": True,\n        \"strip_embedded_objects\": True,\n        \"strip_javascript\": True,\n        \"strip_active_content\": True,\n        \"flatten_pdf\": True,\n        \"reconstruct_to_safe_format\": True,\n        \"max_file_size_mb\": 50,\n        \"allowed_file_types\": [\"pdf\", \"docx\", \"xlsx\", \"pptx\", \"png\", \"jpg\"],\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"Allow Trusted SaaS Direct\",\n    description=\"Allow direct access to sanctioned SaaS applications\",\n    match_criteria={\n        \"url_categories\": [\"cloud_productivity\", \"business_saas\"],\n        \"domains\": [\n            \"*.office365.com\", \"*.office.com\", \"*.microsoft.com\",\n            \"*.salesforce.com\", \"*.slack.com\", \"*.github.com\",\n        ],\n        \"risk_levels\": [\"low\"],\n    },\n    isolation_mode=\"allow_direct\",\n    dlp_controls={\n        \"disable_copy_paste\": False,\n        \"disable_download\": False,\n        \"disable_upload\": False,\n        \"log_all_downloads\": True,\n    },\n)\n\n# List all policies\nfor policy in engine.list_policies():\n    print(f\"  [{policy['priority']}] {policy['name']} -> {policy['isolation_mode']}\")\n```\n\n### Phase 3: Content Disarming and Reconstruction (CDR)\n\nImplement CDR processing to sanitize downloaded files by deconstructing them,\nstripping potentially malicious elements (macros, embedded objects, scripts),\nand reconstructing clean versions that preserve usability.\n\n```python\n# Process a file through CDR\ncdr_result = engine.process_file_cdr(\n    file_path=\"\u002Ftmp\u002Fdownloads\u002Fquarterly_report.docx\",\n    source_url=\"https:\u002F\u002Fpartner-portal.example.com\u002Freports\u002Fq4.docx\",\n    cdr_profile=\"strict\",\n)\n\nprint(f\"Original file: {cdr_result['original']['filename']}\")\nprint(f\"Original size: {cdr_result['original']['size_bytes']} bytes\")\nprint(f\"Threats found: {cdr_result['threats_found']}\")\nfor threat in cdr_result['threats_detail']:\n    print(f\"  - {threat['type']}: {threat['description']} [{threat['action']}]\")\nprint(f\"Clean file: {cdr_result['reconstructed']['filename']}\")\nprint(f\"Clean size: {cdr_result['reconstructed']['size_bytes']} bytes\")\nprint(f\"File integrity preserved: {cdr_result['reconstructed']['usable']}\")\n\n# Example output:\n# Original file: quarterly_report.docx\n# Original size: 245760 bytes\n# Threats found: 3\n#   - macro: VBA macro with AutoOpen trigger [STRIPPED]\n#   - embedded_ole: Embedded OLE object (executable) [STRIPPED]\n#   - external_link: External template reference [STRIPPED]\n# Clean file: quarterly_report_clean.docx\n# Clean size: 198432 bytes\n# File integrity preserved: True\n```\n\n### Phase 4: Session Control and Monitoring\n\nImplement real-time session monitoring for isolated browsing sessions with\nkeystroke logging policy, clipboard interception, and download tracking.\nIntegrate with SIEM for security event correlation.\n\n```python\n# Create an isolation session\nsession = engine.create_isolation_session(\n    user_id=\"jsmith@acme.com\",\n    user_groups=[\"engineering\", \"contractors\"],\n    device_posture={\n        \"os\": \"Windows 11\",\n        \"managed\": True,\n        \"edr_running\": True,\n        \"disk_encrypted\": True,\n        \"os_patched\": True,\n    },\n    target_url=\"https:\u002F\u002Fexternal-vendor.example.com\u002Fportal\",\n)\n\nprint(f\"Session ID: {session['session_id']}\")\nprint(f\"Isolation Mode: {session['isolation_mode']}\")\nprint(f\"Applied Policy: {session['applied_policy']}\")\nprint(f\"DLP Controls: {json.dumps(session['dlp_controls'], indent=2)}\")\n\n# Monitor session events\nevents = engine.get_session_events(session_id=session[\"session_id\"])\nfor event in events:\n    print(f\"  [{event['timestamp']}] {event['event_type']}: {event['details']}\")\n\n# Generate session audit report\naudit = engine.generate_session_audit(\n    user_id=\"jsmith@acme.com\",\n    date_range=(\"2026-03-01\", \"2026-03-19\"),\n)\nprint(f\"Total sessions: {audit['total_sessions']}\")\nprint(f\"Isolated sessions: {audit['isolated_sessions']}\")\nprint(f\"Files processed via CDR: {audit['cdr_processed_files']}\")\nprint(f\"DLP violations: {audit['dlp_violations']}\")\n```\n\n### Phase 5: Integration with Zero Trust Platform\n\nIntegrate browser isolation with the broader Zero Trust architecture including\nidentity provider, device posture checks, and conditional access policies.\n\n```python\n# Define Zero Trust conditional access integration\nzt_policy = engine.create_zero_trust_integration(\n    identity_provider=\"Azure AD\",\n    conditional_access_rules=[\n        {\n            \"name\": \"Unmanaged Device Isolation\",\n            \"condition\": {\"device_managed\": False},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"disable_download\": True, \"disable_upload\": True},\n        },\n        {\n            \"name\": \"High Risk User Isolation\",\n            \"condition\": {\"user_risk_level\": \"high\"},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"disable_copy_paste\": True, \"watermark_session\": True},\n        },\n        {\n            \"name\": \"Contractor Restricted Access\",\n            \"condition\": {\"user_group\": \"contractors\"},\n            \"action\": \"read_only_isolation\",\n            \"dlp_override\": {\"disable_download\": True, \"disable_printing\": True},\n        },\n        {\n            \"name\": \"Privileged Admin Isolation\",\n            \"condition\": {\"user_group\": \"admins\", \"target_category\": \"admin_console\"},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"watermark_session\": True, \"record_session\": True},\n        },\n    ],\n    swg_integration={\n        \"proxy_mode\": \"explicit\",\n        \"pac_url\": \"https:\u002F\u002Fpac.acme.com\u002Fproxy.pac\",\n        \"ssl_inspection\": True,\n        \"bypass_domains\": [\"*.acme.internal\"],\n    },\n)\n\n# Evaluate a request against all policies\ndecision = engine.evaluate_access_request(\n    user_id=\"contractor@vendor.com\",\n    user_groups=[\"contractors\"],\n    device_posture={\"managed\": False, \"edr_running\": False},\n    target_url=\"https:\u002F\u002Fsensitive-app.acme.com\u002Fdashboard\",\n    user_risk_level=\"medium\",\n)\nprint(f\"Decision: {decision['action']}\")\nprint(f\"Matched Rules: {[r['name'] for r in decision['matched_rules']]}\")\nprint(f\"DLP Controls: {decision['effective_dlp_controls']}\")\n```\n\n## Examples\n\n### Quick Policy Deployment for Phishing Protection\n\n```python\nengine = BrowserIsolationPolicyEngine(default_isolation_mode=\"isolate_risky\")\n\n# Isolate all links from email\nengine.add_isolation_policy(\n    name=\"Email Link Isolation\",\n    description=\"Isolate all URLs clicked from email clients\",\n    match_criteria={\n        \"referrer_categories\": [\"email_client\"],\n        \"url_categories\": [\"*\"],\n    },\n    isolation_mode=\"full_isolation\",\n    dlp_controls={\n        \"disable_keyboard_input\": True,\n        \"disable_download\": True,\n        \"watermark_session\": True,\n    },\n)\n\n# Test against a phishing URL\nresult = engine.evaluate_access_request(\n    user_id=\"user@acme.com\",\n    target_url=\"https:\u002F\u002Fmicr0soft-login.phishing.com\u002Fauth\",\n    referrer=\"https:\u002F\u002Fmail.google.com\",\n    user_risk_level=\"low\",\n)\nprint(f\"Action: {result['action']}\")  # full_isolation\n```\n\n### CDR Pipeline for All Downloads\n\n```python\nengine = BrowserIsolationPolicyEngine()\n\n# Scan a batch of downloaded files through CDR\nfiles = [\n    \"\u002Ftmp\u002Fdownloads\u002Finvoice.pdf\",\n    \"\u002Ftmp\u002Fdownloads\u002Fcontract.docx\",\n    \"\u002Ftmp\u002Fdownloads\u002Fdata_export.xlsx\",\n    \"\u002Ftmp\u002Fdownloads\u002Fpresentation.pptx\",\n]\n\nbatch_result = engine.batch_cdr_process(\n    files=files,\n    cdr_profile=\"strict\",\n    quarantine_on_threat=True,\n)\n\nprint(f\"Processed: {batch_result['total_processed']}\")\nprint(f\"Clean: {batch_result['clean_count']}\")\nprint(f\"Threats neutralized: {batch_result['threats_neutralized']}\")\nprint(f\"Quarantined: {batch_result['quarantined_count']}\")\nfor f in batch_result[\"results\"]:\n    status = \"CLEAN\" if f[\"clean\"] else \"SANITIZED\"\n    print(f\"  [{status}] {f['filename']}: {f['threats_found']} threats\")\n```\n\n### Generating Isolation Policy Compliance Report\n\n```python\nengine = BrowserIsolationPolicyEngine()\n\nreport = engine.generate_compliance_report(\n    date_range=(\"2026-03-01\", \"2026-03-19\"),\n    include_metrics=True,\n)\n\nprint(f\"Total web requests: {report['total_requests']}\")\nprint(f\"Isolated requests: {report['isolated_requests']} ({report['isolation_rate']}%)\")\nprint(f\"CDR processed files: {report['cdr_stats']['total_files']}\")\nprint(f\"Threats neutralized: {report['cdr_stats']['threats_neutralized']}\")\nprint(f\"DLP violations blocked: {report['dlp_violations_blocked']}\")\nprint(f\"Zero-day attacks prevented: {report['zero_day_blocked']}\")\n```\n","# Implementing Browser Isolation for Zero Trust\n\n## When to Use\n\n- When deploying remote browser isolation as part of a Zero Trust security architecture\n- When protecting users from zero-day browser exploits and drive-by downloads\n- When implementing content disarming and reconstruction for file downloads\n- When enforcing data loss prevention policies for web browsing sessions\n- When securing access to untrusted or uncategorized websites\n- When integrating browser isolation with existing SWG and ZTNA infrastructure\n- When protecting against phishing and credential theft via isolated rendering\n\n## Prerequisites\n\n- Familiarity with Zero Trust architecture principles and network security\n- Understanding of Secure Web Gateway (SWG) and proxy deployment models\n- Access to a test or lab environment for policy validation\n- Python 3.8+ with required dependencies installed\n- DNS and proxy infrastructure for traffic routing\n\n## Instructions\n\n### Phase 1: URL Categorization and Risk Classification\n\nBuild a URL categorization engine that classifies websites by risk level to\ndetermine isolation policy. URLs are scored based on threat intelligence feeds,\ndomain reputation, content category, and historical risk indicators.\n\n```python\nfrom agent import BrowserIsolationPolicyEngine\n\nengine = BrowserIsolationPolicyEngine(\n    organization=\"Acme Corp\",\n    default_isolation_mode=\"isolate_risky\",\n)\n\n# Classify a URL and determine isolation action\nresult = engine.classify_url(\"https:\u002F\u002Fdocs.google.com\u002Fspreadsheets\u002Fd\u002Fabc123\")\nprint(f\"Category: {result['category']}\")\nprint(f\"Risk Level: {result['risk_level']}\")\nprint(f\"Isolation Action: {result['action']}\")\n# Output: Category: cloud_productivity\n#         Risk Level: low\n#         Action: allow_direct\n\nresult = engine.classify_url(\"https:\u002F\u002Funknown-sketchy-domain.xyz\u002Fdownload.html\")\nprint(f\"Category: {result['category']}\")\nprint(f\"Risk Level: {result['risk_level']}\")\nprint(f\"Isolation Action: {result['action']}\")\n# Output: Category: uncategorized\n#         Risk Level: high\n#         Action: full_isolation\n```\n\n### Phase 2: Isolation Policy Configuration\n\nDefine isolation policies that map URL categories and risk levels to specific\nisolation modes and DLP restrictions. Policies support granular controls including\nclipboard, file download, upload, and printing restrictions.\n\n```python\n# Configure isolation policies\nengine.add_isolation_policy(\n    name=\"Block Uncategorized Sites\",\n    description=\"Fully isolate all uncategorized or newly registered domains\",\n    match_criteria={\n        \"url_categories\": [\"uncategorized\", \"newly_registered\"],\n        \"risk_levels\": [\"high\", \"critical\"],\n    },\n    isolation_mode=\"full_isolation\",\n    dlp_controls={\n        \"disable_copy_paste\": True,\n        \"disable_download\": True,\n        \"disable_upload\": True,\n        \"disable_printing\": True,\n        \"disable_keyboard_input\": False,\n        \"watermark_session\": True,\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"Isolate Webmail with DLP\",\n    description=\"Isolate personal webmail with download restrictions\",\n    match_criteria={\n        \"url_categories\": [\"webmail\"],\n        \"domains\": [\"mail.google.com\", \"outlook.live.com\", \"mail.yahoo.com\"],\n    },\n    isolation_mode=\"read_only_isolation\",\n    dlp_controls={\n        \"disable_copy_paste\": True,\n        \"disable_download\": True,\n        \"disable_upload\": True,\n        \"disable_printing\": True,\n        \"disable_keyboard_input\": False,\n        \"watermark_session\": False,\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"CDR for File Downloads\",\n    description=\"Apply content disarm and reconstruction to all file downloads\",\n    match_criteria={\n        \"url_categories\": [\"*\"],\n        \"file_types\": [\"pdf\", \"docx\", \"xlsx\", \"pptx\", \"zip\", \"exe\", \"msi\"],\n    },\n    isolation_mode=\"cdr_passthrough\",\n    cdr_config={\n        \"strip_macros\": True,\n        \"strip_embedded_objects\": True,\n        \"strip_javascript\": True,\n        \"strip_active_content\": True,\n        \"flatten_pdf\": True,\n        \"reconstruct_to_safe_format\": True,\n        \"max_file_size_mb\": 50,\n        \"allowed_file_types\": [\"pdf\", \"docx\", \"xlsx\", \"pptx\", \"png\", \"jpg\"],\n    },\n)\n\nengine.add_isolation_policy(\n    name=\"Allow Trusted SaaS Direct\",\n    description=\"Allow direct access to sanctioned SaaS applications\",\n    match_criteria={\n        \"url_categories\": [\"cloud_productivity\", \"business_saas\"],\n        \"domains\": [\n            \"*.office365.com\", \"*.office.com\", \"*.microsoft.com\",\n            \"*.salesforce.com\", \"*.slack.com\", \"*.github.com\",\n        ],\n        \"risk_levels\": [\"low\"],\n    },\n    isolation_mode=\"allow_direct\",\n    dlp_controls={\n        \"disable_copy_paste\": False,\n        \"disable_download\": False,\n        \"disable_upload\": False,\n        \"log_all_downloads\": True,\n    },\n)\n\n# List all policies\nfor policy in engine.list_policies():\n    print(f\"  [{policy['priority']}] {policy['name']} -> {policy['isolation_mode']}\")\n```\n\n### Phase 3: Content Disarming and Reconstruction (CDR)\n\nImplement CDR processing to sanitize downloaded files by deconstructing them,\nstripping potentially malicious elements (macros, embedded objects, scripts),\nand reconstructing clean versions that preserve usability.\n\n```python\n# Process a file through CDR\ncdr_result = engine.process_file_cdr(\n    file_path=\"\u002Ftmp\u002Fdownloads\u002Fquarterly_report.docx\",\n    source_url=\"https:\u002F\u002Fpartner-portal.example.com\u002Freports\u002Fq4.docx\",\n    cdr_profile=\"strict\",\n)\n\nprint(f\"Original file: {cdr_result['original']['filename']}\")\nprint(f\"Original size: {cdr_result['original']['size_bytes']} bytes\")\nprint(f\"Threats found: {cdr_result['threats_found']}\")\nfor threat in cdr_result['threats_detail']:\n    print(f\"  - {threat['type']}: {threat['description']} [{threat['action']}]\")\nprint(f\"Clean file: {cdr_result['reconstructed']['filename']}\")\nprint(f\"Clean size: {cdr_result['reconstructed']['size_bytes']} bytes\")\nprint(f\"File integrity preserved: {cdr_result['reconstructed']['usable']}\")\n\n# Example output:\n# Original file: quarterly_report.docx\n# Original size: 245760 bytes\n# Threats found: 3\n#   - macro: VBA macro with AutoOpen trigger [STRIPPED]\n#   - embedded_ole: Embedded OLE object (executable) [STRIPPED]\n#   - external_link: External template reference [STRIPPED]\n# Clean file: quarterly_report_clean.docx\n# Clean size: 198432 bytes\n# File integrity preserved: True\n```\n\n### Phase 4: Session Control and Monitoring\n\nImplement real-time session monitoring for isolated browsing sessions with\nkeystroke logging policy, clipboard interception, and download tracking.\nIntegrate with SIEM for security event correlation.\n\n```python\n# Create an isolation session\nsession = engine.create_isolation_session(\n    user_id=\"jsmith@acme.com\",\n    user_groups=[\"engineering\", \"contractors\"],\n    device_posture={\n        \"os\": \"Windows 11\",\n        \"managed\": True,\n        \"edr_running\": True,\n        \"disk_encrypted\": True,\n        \"os_patched\": True,\n    },\n    target_url=\"https:\u002F\u002Fexternal-vendor.example.com\u002Fportal\",\n)\n\nprint(f\"Session ID: {session['session_id']}\")\nprint(f\"Isolation Mode: {session['isolation_mode']}\")\nprint(f\"Applied Policy: {session['applied_policy']}\")\nprint(f\"DLP Controls: {json.dumps(session['dlp_controls'], indent=2)}\")\n\n# Monitor session events\nevents = engine.get_session_events(session_id=session[\"session_id\"])\nfor event in events:\n    print(f\"  [{event['timestamp']}] {event['event_type']}: {event['details']}\")\n\n# Generate session audit report\naudit = engine.generate_session_audit(\n    user_id=\"jsmith@acme.com\",\n    date_range=(\"2026-03-01\", \"2026-03-19\"),\n)\nprint(f\"Total sessions: {audit['total_sessions']}\")\nprint(f\"Isolated sessions: {audit['isolated_sessions']}\")\nprint(f\"Files processed via CDR: {audit['cdr_processed_files']}\")\nprint(f\"DLP violations: {audit['dlp_violations']}\")\n```\n\n### Phase 5: Integration with Zero Trust Platform\n\nIntegrate browser isolation with the broader Zero Trust architecture including\nidentity provider, device posture checks, and conditional access policies.\n\n```python\n# Define Zero Trust conditional access integration\nzt_policy = engine.create_zero_trust_integration(\n    identity_provider=\"Azure AD\",\n    conditional_access_rules=[\n        {\n            \"name\": \"Unmanaged Device Isolation\",\n            \"condition\": {\"device_managed\": False},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"disable_download\": True, \"disable_upload\": True},\n        },\n        {\n            \"name\": \"High Risk User Isolation\",\n            \"condition\": {\"user_risk_level\": \"high\"},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"disable_copy_paste\": True, \"watermark_session\": True},\n        },\n        {\n            \"name\": \"Contractor Restricted Access\",\n            \"condition\": {\"user_group\": \"contractors\"},\n            \"action\": \"read_only_isolation\",\n            \"dlp_override\": {\"disable_download\": True, \"disable_printing\": True},\n        },\n        {\n            \"name\": \"Privileged Admin Isolation\",\n            \"condition\": {\"user_group\": \"admins\", \"target_category\": \"admin_console\"},\n            \"action\": \"full_isolation\",\n            \"dlp_override\": {\"watermark_session\": True, \"record_session\": True},\n        },\n    ],\n    swg_integration={\n        \"proxy_mode\": \"explicit\",\n        \"pac_url\": \"https:\u002F\u002Fpac.acme.com\u002Fproxy.pac\",\n        \"ssl_inspection\": True,\n        \"bypass_domains\": [\"*.acme.internal\"],\n    },\n)\n\n# Evaluate a request against all policies\ndecision = engine.evaluate_access_request(\n    user_id=\"contractor@vendor.com\",\n    user_groups=[\"contractors\"],\n    device_posture={\"managed\": False, \"edr_running\": False},\n    target_url=\"https:\u002F\u002Fsensitive-app.acme.com\u002Fdashboard\",\n    user_risk_level=\"medium\",\n)\nprint(f\"Decision: {decision['action']}\")\nprint(f\"Matched Rules: {[r['name'] for r in decision['matched_rules']]}\")\nprint(f\"DLP Controls: {decision['effective_dlp_controls']}\")\n```\n\n## Examples\n\n### Quick Policy Deployment for Phishing Protection\n\n```python\nengine = BrowserIsolationPolicyEngine(default_isolation_mode=\"isolate_risky\")\n\n# Isolate all links from email\nengine.add_isolation_policy(\n    name=\"Email Link Isolation\",\n    description=\"Isolate all URLs clicked from email clients\",\n    match_criteria={\n        \"referrer_categories\": [\"email_client\"],\n        \"url_categories\": [\"*\"],\n    },\n    isolation_mode=\"full_isolation\",\n    dlp_controls={\n        \"disable_keyboard_input\": True,\n        \"disable_download\": True,\n        \"watermark_session\": True,\n    },\n)\n\n# Test against a phishing URL\nresult = engine.evaluate_access_request(\n    user_id=\"user@acme.com\",\n    target_url=\"https:\u002F\u002Fmicr0soft-login.phishing.com\u002Fauth\",\n    referrer=\"https:\u002F\u002Fmail.google.com\",\n    user_risk_level=\"low\",\n)\nprint(f\"Action: {result['action']}\")  # full_isolation\n```\n\n### CDR Pipeline for All Downloads\n\n```python\nengine = BrowserIsolationPolicyEngine()\n\n# Scan a batch of downloaded files through CDR\nfiles = [\n    \"\u002Ftmp\u002Fdownloads\u002Finvoice.pdf\",\n    \"\u002Ftmp\u002Fdownloads\u002Fcontract.docx\",\n    \"\u002Ftmp\u002Fdownloads\u002Fdata_export.xlsx\",\n    \"\u002Ftmp\u002Fdownloads\u002Fpresentation.pptx\",\n]\n\nbatch_result = engine.batch_cdr_process(\n    files=files,\n    cdr_profile=\"strict\",\n    quarantine_on_threat=True,\n)\n\nprint(f\"Processed: {batch_result['total_processed']}\")\nprint(f\"Clean: {batch_result['clean_count']}\")\nprint(f\"Threats neutralized: {batch_result['threats_neutralized']}\")\nprint(f\"Quarantined: {batch_result['quarantined_count']}\")\nfor f in batch_result[\"results\"]:\n    status = \"CLEAN\" if f[\"clean\"] else \"SANITIZED\"\n    print(f\"  [{status}] {f['filename']}: {f['threats_found']} threats\")\n```\n\n### Generating Isolation Policy Compliance Report\n\n```python\nengine = BrowserIsolationPolicyEngine()\n\nreport = engine.generate_compliance_report(\n    date_range=(\"2026-03-01\", \"2026-03-19\"),\n    include_metrics=True,\n)\n\nprint(f\"Total web requests: {report['total_requests']}\")\nprint(f\"Isolated requests: {report['isolated_requests']} ({report['isolation_rate']}%)\")\nprint(f\"CDR processed files: {report['cdr_stats']['total_files']}\")\nprint(f\"Threats neutralized: {report['cdr_stats']['threats_neutralized']}\")\nprint(f\"DLP violations blocked: {report['dlp_violations_blocked']}\")\nprint(f\"Zero-day attacks prevented: {report['zero_day_blocked']}\")\n```\n",{"name":5,"tags":49,"author":9,"domain":42,"license":15,"version":56,"mitre_f3":57,"nist_csf":83,"subdomain":88,"description":89,"mitre_attack":90},[50,34,51,52,53,54,55],"browser-isolation","RBI","CDR","URL-categorization","content-disarming","secure-web-gateway","1.0",{"tactics":58,"version":61,"techniques":62},[29,59,60],"positioning","execution","1.1",[63,67,70,73,77,80],{"id":64,"name":65,"source":66,"tactic":29},"T1660","Phishing","attack",{"id":68,"name":69,"source":66,"tactic":59},"T1557","Adversary-in-the-Middle",{"id":71,"name":72,"source":66,"tactic":59},"T1185","Browser Session Hijacking",{"id":74,"name":75,"source":76,"tactic":59},"F1007","Adversary-in-the-Browser","f3",{"id":78,"name":79,"source":76,"tactic":59},"F1007.002","Adversary-in-the-Browser: Malicious Browser Extension",{"id":81,"name":82,"source":76,"tactic":60},"F1007.003","Adversary-in-the-Browser: Malicious JavaScript Injection",[84,85,86,87],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","network-security","Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.\n",[91,92,68,93,94],"T1046","T1040","T1071","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-browser-isolation-for-zero-trust",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":106,"prompt":116,"zipAvailable":117},[107,110,113],{"tool":108,"command":109},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-browser-isolation-for-zero-trust",{"tool":111,"command":112},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-browser-isolation-for-zero-trust",{"tool":114,"command":115},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-browser-isolation-for-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-browser-isolation-for-zero-trust\u002FSKILL.md",true,[119,124,130],{"path":120,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-browser-isolation-for-zero-trust\u002FLICENSE",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md","REFERENCE","参考文档",9387,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-browser-isolation-for-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",42684,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-browser-isolation-for-zero-trust\u002Fscripts\u002Fagent.py",[137,167,190,218,242,269],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":148,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[149,150,151,152,43,42,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":174,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[173],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},[175,163,176,177,43,178,42,155,179,26,180,181,182,183,184,185,186,187,188,189],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":200,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[196,199],{"categoryNo":197,"categoryName":198,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},[184,201,202,203,204,42,205,206,179,207,208,209,210,211,212,213,214,215,216,217],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":225,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[224],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},[226,227,228,42,229,25,230,231,232,233,234,35,235,236,237,238,181,239,240,241],"windows","kape","triaging windows with kape","registry","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[248],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},[250,251,252,42,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":270,"name":271,"nameZh":6,"description":272,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":273,"categories":274,"keywords":276,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[275],{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},[43,277,42,278,279,280,281,282,283,284,285,213,60,214,286,287,288,289,290,291],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]