[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF1H9693FRCJDGDWNRN9PK":3,"skill-same:01M6AF1H9693FRCJDGDWNRN9PK":130},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":37,"publishedAt":58,"linkOnly":59,"markdownContent":60,"markdownBody":61,"frontMatter":62,"refName":89,"commitSha":90,"skillDirectory":91,"forksCount":92,"repositoryHtmlUrl":93,"repositoryHomepageUrl":94,"ownerHtmlUrl":95,"ownerBlogUrl":96,"ownerDescription":97,"updatedAt":98,"install":99,"resources":112},"01M6AF1H9693FRCJDGDWNRN9PK","implementing-cloud-dlp-for-data-protection",null,"Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft Purview, Azure Information Protection, and Nightfall AI to discover, classify, label, de-identify, and protect sensitive data (PII, PHI, financial data) across cloud storage, databases, and pipelines. Use for GDPR\u002FHIPAA\u002FPCI DSS data-discovery, cloud data governance, or CI\u002FCD DLP scanning; not for endpoint, email, or network-level DLP.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-dlp-for-data-protection\u002FSKILL.md",[18,23,26,29,34],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000033","数据分析师",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"data protection","implementing cloud dlp for data protection","dlp","data","cloud","purview","pr","storage","ci","cloud-security","google","network","cybersecurity","endpoint","security","macie","t1078","data-classification","pii","google cloud","2026-11-10 10:12:30",false,"---\nname: implementing-cloud-dlp-for-data-protection\ndescription: 'Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft\n  Purview, Azure Information Protection, and Nightfall AI to discover, classify, label,\n  de-identify, and protect sensitive data (PII, PHI, financial data) across cloud\n  storage, databases, and pipelines. Use for GDPR\u002FHIPAA\u002FPCI DSS data-discovery, cloud\n  data governance, or CI\u002FCD DLP scanning; not for endpoint, email, or network-level\n  DLP.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- dlp\n- data-protection\n- macie\n- data-classification\n- privacy\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\n- MEASURE-2.8\n- MEASURE-2.9\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Implementing Cloud DLP for Data Protection\n\n## When to Use\n\n- When compliance frameworks (GDPR, HIPAA, PCI DSS) require automated sensitive data discovery and protection\n- When building data governance programs that classify and label data across cloud storage\n- When implementing data loss prevention controls for cloud-based data pipelines\n- When auditing cloud environments for unprotected sensitive data (PII, PHI, financial data)\n- When integrating DLP scanning into CI\u002FCD pipelines to prevent sensitive data from reaching production\n\n**Do not use** for endpoint DLP (use Microsoft Purview or Symantec DLP agents), for email DLP (use Microsoft 365 DLP or Google Workspace DLP), or for network-level data exfiltration prevention (use VPC endpoint policies and network firewalls).\n\n## Prerequisites\n\n- Amazon Macie enabled with appropriate S3 bucket permissions\n- Google Cloud DLP API enabled (`gcloud services enable dlp.googleapis.com`)\n- Azure Information Protection or Microsoft Purview configured\n- IAM permissions for DLP service administration and data access\n- Knowledge of data sensitivity categories relevant to the organization (PII, PHI, PCI, proprietary)\n\n## Workflow\n\n### Step 1: Deploy Amazon Macie for S3 Data Discovery\n\nEnable Macie and configure automated sensitive data discovery jobs for S3 buckets.\n\n```bash\n# Enable Amazon Macie\naws macie2 enable-macie\n\n# List all S3 buckets Macie can scan\naws macie2 describe-buckets \\\n  --query 'buckets[*].[bucketName,classifiableSizeInBytes,unclassifiableObjectCount.total]' \\\n  --output table\n\n# Create a classification job for specific buckets\naws macie2 create-classification-job \\\n  --job-type SCHEDULED \\\n  --name \"weekly-pii-scan\" \\\n  --schedule-frequency-details '{\"weekly\":{\"dayOfWeek\":\"MONDAY\"}}' \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"ACCOUNT_ID\",\n      \"buckets\": [\"customer-data-bucket\", \"analytics-data-lake\", \"backup-bucket\"]\n    }],\n    \"scoping\": {\n      \"includes\": {\n        \"and\": [{\n          \"simpleScopeTerm\": {\n            \"key\": \"OBJECT_EXTENSION\",\n            \"values\": [\"csv\", \"json\", \"parquet\", \"txt\", \"xlsx\"],\n            \"comparator\": \"EQ\"\n          }\n        }]\n      }\n    }\n  }' \\\n  --managed-data-identifier-ids '[\"SSN\",\"CREDIT_CARD_NUMBER\",\"EMAIL_ADDRESS\",\"AWS_CREDENTIALS\",\"PHONE_NUMBER\"]'\n\n# Create custom data identifier for internal employee IDs\naws macie2 create-custom-data-identifier \\\n  --name \"EmployeeID\" \\\n  --regex \"EMP-[0-9]{6}\" \\\n  --description \"Internal employee ID format\"\n\n# Check job status and results\naws macie2 list-classification-jobs \\\n  --query 'items[*].[name,jobStatus,statistics.approximateNumberOfObjectsToProcess]' \\\n  --output table\n```\n\n### Step 2: Configure Google Cloud DLP API for Data Inspection\n\nUse Google Cloud DLP to inspect and de-identify sensitive data across GCP resources.\n\n```bash\n# Inspect a Cloud Storage bucket for sensitive data\ngcloud dlp inspect-content \\\n  --content-type=TEXT_PLAIN \\\n  --min-likelihood=LIKELY \\\n  --info-types=PHONE_NUMBER,EMAIL_ADDRESS,CREDIT_CARD_NUMBER,US_SOCIAL_SECURITY_NUMBER \\\n  --storage-type=CLOUD_STORAGE \\\n  --gcs-uri=\"gs:\u002F\u002Fsensitive-data-bucket\u002Fdata\u002F*.csv\"\n\n# Create an inspection job for BigQuery\ncat > dlp-job.json \u003C\u003C 'EOF'\n{\n  \"inspectJob\": {\n    \"storageConfig\": {\n      \"bigQueryOptions\": {\n        \"tableReference\": {\n          \"projectId\": \"PROJECT_ID\",\n          \"datasetId\": \"customer_data\",\n          \"tableId\": \"transactions\"\n        },\n        \"sampleMethod\": \"RANDOM_START\",\n        \"rowsLimit\": 10000\n      }\n    },\n    \"inspectConfig\": {\n      \"infoTypes\": [\n        {\"name\": \"CREDIT_CARD_NUMBER\"},\n        {\"name\": \"US_SOCIAL_SECURITY_NUMBER\"},\n        {\"name\": \"EMAIL_ADDRESS\"},\n        {\"name\": \"PHONE_NUMBER\"},\n        {\"name\": \"PERSON_NAME\"}\n      ],\n      \"minLikelihood\": \"LIKELY\",\n      \"limits\": {\"maxFindingsPerRequest\": 1000}\n    },\n    \"actions\": [{\n      \"saveFindings\": {\n        \"outputConfig\": {\n          \"table\": {\n            \"projectId\": \"PROJECT_ID\",\n            \"datasetId\": \"dlp_results\",\n            \"tableId\": \"findings\"\n          }\n        }\n      }\n    }]\n  }\n}\nEOF\n\ngcloud dlp jobs create --project=PROJECT_ID --body-from-file=dlp-job.json\n```\n\n### Step 3: Implement Data De-identification with Cloud DLP\n\nConfigure de-identification transforms to mask, tokenize, or redact sensitive data.\n\n```python\n# deidentify_pipeline.py - De-identify sensitive data using Google Cloud DLP\nfrom google.cloud import dlp_v2\n\ndef deidentify_data(project_id, text):\n    \"\"\"De-identify PII in text using Cloud DLP.\"\"\"\n    client = dlp_v2.DlpServiceClient()\n\n    inspect_config = {\n        \"info_types\": [\n            {\"name\": \"EMAIL_ADDRESS\"},\n            {\"name\": \"PHONE_NUMBER\"},\n            {\"name\": \"CREDIT_CARD_NUMBER\"},\n            {\"name\": \"US_SOCIAL_SECURITY_NUMBER\"},\n        ],\n        \"min_likelihood\": dlp_v2.Likelihood.LIKELY,\n    }\n\n    deidentify_config = {\n        \"info_type_transformations\": {\n            \"transformations\": [\n                {\n                    \"info_types\": [{\"name\": \"EMAIL_ADDRESS\"}],\n                    \"primitive_transformation\": {\n                        \"character_mask_config\": {\n                            \"masking_character\": \"*\",\n                            \"number_to_mask\": 0,\n                            \"characters_to_ignore\": [\n                                {\"common_characters_to_ignore\": \"PUNCTUATION\"}\n                            ],\n                        }\n                    },\n                },\n                {\n                    \"info_types\": [{\"name\": \"CREDIT_CARD_NUMBER\"}],\n                    \"primitive_transformation\": {\n                        \"crypto_replace_ffx_fpe_config\": {\n                            \"crypto_key\": {\n                                \"kms_wrapped\": {\n                                    \"wrapped_key\": \"WRAPPED_KEY_BASE64\",\n                                    \"crypto_key_name\": \"projects\u002FPROJECT\u002Flocations\u002Fglobal\u002FkeyRings\u002Fdlp\u002FcryptoKeys\u002Ftokenization\",\n                                }\n                            },\n                            \"common_alphabet\": \"NUMERIC\",\n                        }\n                    },\n                },\n                {\n                    \"info_types\": [{\"name\": \"US_SOCIAL_SECURITY_NUMBER\"}],\n                    \"primitive_transformation\": {\n                        \"redact_config\": {}\n                    },\n                },\n            ]\n        }\n    }\n\n    item = {\"value\": text}\n    parent = f\"projects\u002F{project_id}\u002Flocations\u002Fglobal\"\n\n    response = client.deidentify_content(\n        request={\n            \"parent\": parent,\n            \"deidentify_config\": deidentify_config,\n            \"inspect_config\": inspect_config,\n            \"item\": item,\n        }\n    )\n    return response.item.value\n```\n\n### Step 4: Configure Azure Information Protection\n\nSet up sensitivity labels and DLP policies in Microsoft Purview for Azure resources.\n\n```powershell\n# Connect to Microsoft Purview compliance\nConnect-IPPSSession\n\n# Create sensitivity labels\nNew-Label -DisplayName \"Confidential - PII\" \\\n  -Name \"Confidential-PII\" \\\n  -Tooltip \"Contains personally identifiable information\" \\\n  -ContentType \"File, Email\"\n\nNew-Label -DisplayName \"Highly Confidential - Financial\" \\\n  -Name \"HighlyConfidential-Financial\" \\\n  -Tooltip \"Contains financial data subject to PCI DSS\" \\\n  -ContentType \"File, Email\"\n\n# Create auto-labeling policy for Azure Storage\nNew-AutoSensitivityLabelPolicy -Name \"Auto-Label-PII\" \\\n  -ExchangeLocation All \\\n  -SharePointLocation All \\\n  -OneDriveLocation All \\\n  -Mode Enable\n\nNew-AutoSensitivityLabelRule -Policy \"Auto-Label-PII\" \\\n  -Name \"Detect-SSN\" \\\n  -ContentContainsSensitiveInformation @{\n    Name = \"U.S. Social Security Number (SSN)\";\n    MinCount = 1;\n    MinConfidence = 85\n  } \\\n  -ApplySensitivityLabel \"Confidential-PII\"\n```\n\n```bash\n# Azure: Configure DLP policy for Storage accounts\naz security assessment create \\\n  --name \"storage-sensitive-data\" \\\n  --assessed-resource-type \"Microsoft.Storage\u002FstorageAccounts\"\n\n# Enable Microsoft Defender for Storage with sensitive data threat detection\naz security pricing create --name StorageAccounts --tier standard \\\n  --subplan DefenderForStorageV2 \\\n  --extensions '[{\"name\":\"SensitiveDataDiscovery\",\"isEnabled\":\"True\"}]'\n```\n\n### Step 5: Integrate DLP into Data Pipelines\n\nAdd DLP scanning to ETL and data pipeline workflows to prevent sensitive data leakage.\n\n```python\n# pipeline_dlp_gate.py - DLP gate for data pipelines\nimport boto3\nimport json\n\nmacie_client = boto3.client('macie2')\ns3_client = boto3.client('s3')\n\ndef scan_pipeline_output(bucket, prefix):\n    \"\"\"Scan pipeline output data for sensitive content before promotion.\"\"\"\n    job_response = macie_client.create_classification_job(\n        jobType='ONE_TIME',\n        name=f'pipeline-scan-{prefix}',\n        s3JobDefinition={\n            'bucketDefinitions': [{\n                'accountId': boto3.client('sts').get_caller_identity()['Account'],\n                'buckets': [bucket]\n            }],\n            'scoping': {\n                'includes': {\n                    'and': [{\n                        'simpleScopeTerm': {\n                            'key': 'OBJECT_KEY',\n                            'comparator': 'STARTS_WITH',\n                            'values': [prefix]\n                        }\n                    }]\n                }\n            }\n        },\n        managedDataIdentifierSelector='ALL'\n    )\n\n    return job_response['jobId']\n\ndef check_scan_results(job_id):\n    \"\"\"Check if DLP scan found sensitive data.\"\"\"\n    response = macie_client.list_findings(\n        findingCriteria={\n            'criterion': {\n                'classificationDetails.jobId': {'eq': [job_id]},\n                'severity.description': {'eq': ['High', 'Critical']}\n            }\n        }\n    )\n    return len(response.get('findingIds', [])) > 0\n\ndef gate_decision(bucket, prefix):\n    \"\"\"DLP gate: block pipeline if sensitive data found.\"\"\"\n    job_id = scan_pipeline_output(bucket, prefix)\n    has_sensitive_data = check_scan_results(job_id)\n\n    if has_sensitive_data:\n        return {\n            'decision': 'BLOCK',\n            'reason': 'Sensitive data detected in pipeline output',\n            'action': 'Apply de-identification before promoting to production'\n        }\n    return {'decision': 'ALLOW', 'reason': 'No sensitive data detected'}\n```\n\n### Step 6: Monitor DLP Findings and Generate Reports\n\nAggregate DLP findings across cloud providers and generate compliance reports.\n\n```bash\n# Macie: Get finding statistics\naws macie2 get-finding-statistics \\\n  --group-by \"severity.description\" \\\n  --finding-criteria '{\"criterion\":{\"category\":{\"eq\":[\"CLASSIFICATION\"]}}}'\n\n# Macie: List findings by sensitivity type\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"classificationDetails.result.sensitiveData.category\": {\"eq\": [\"PERSONAL_INFORMATION\"]},\n      \"severity.description\": {\"eq\": [\"High\"]}\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}'\n\n# GCP DLP: List job results\ngcloud dlp jobs list --project=PROJECT_ID --filter=\"state=DONE\" \\\n  --format=\"table(name, createTime, inspectDetails.result.processedBytes, inspectDetails.result.totalEstimatedTransformations)\"\n\n# Export Macie findings to S3 for compliance reporting\naws macie2 create-findings-report \\\n  --finding-criteria '{\"criterion\":{\"category\":{\"eq\":[\"CLASSIFICATION\"]}}}' \\\n  --sort-criteria '{\"attributeName\":\"severity.score\",\"orderBy\":\"DESC\"}'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Data Loss Prevention | Security controls and technologies that detect and prevent unauthorized disclosure of sensitive data from cloud environments |\n| Amazon Macie | AWS service using machine learning to discover, classify, and protect sensitive data stored in S3 buckets |\n| Google Cloud DLP | GCP API for inspecting, classifying, and de-identifying sensitive data across Cloud Storage, BigQuery, and Datastore |\n| Data De-identification | Transforming sensitive data using masking, tokenization, encryption, or redaction to remove identifying characteristics while preserving utility |\n| Sensitivity Label | Classification tag applied to data (Confidential, Highly Confidential) that triggers DLP policy enforcement and access controls |\n| Custom Data Identifier | Organization-specific pattern (regex or keyword) added to DLP services to detect proprietary sensitive data formats |\n\n## Tools & Systems\n\n- **Amazon Macie**: ML-powered sensitive data discovery and classification for S3 with automated finding generation\n- **Google Cloud DLP API**: Programmable API for inspecting, classifying, de-identifying, and redacting sensitive data\n- **Microsoft Purview**: Data governance platform with sensitivity labeling, auto-classification, and DLP policy enforcement\n- **Azure Information Protection**: Data classification and labeling service integrated with Microsoft 365 and Azure storage\n- **Nightfall AI**: Third-party cloud DLP tool supporting scanning across SaaS applications and cloud infrastructure\n\n## Common Scenarios\n\n### Scenario: Discovering PII in an Unprotected S3 Data Lake\n\n**Context**: A compliance audit reveals that the analytics team's S3 data lake contains customer PII (names, emails, SSNs) in CSV files without encryption or access controls. The organization must classify all data and implement DLP controls.\n\n**Approach**:\n1. Enable Macie and create a one-time classification job against the data lake bucket\n2. Review Macie findings to identify which objects contain PII and what types\n3. Create custom data identifiers for organization-specific formats (employee IDs, account numbers)\n4. Implement a weekly scheduled Macie job for ongoing discovery\n5. Build a data pipeline gate that scans new data before promotion to the data lake\n6. Apply de-identification transforms (masking SSNs, tokenizing emails) for analytics use cases\n7. Configure S3 bucket policies to restrict access to classified data to authorized roles only\n\n**Pitfalls**: Macie charges per GB scanned. Large data lakes can generate significant costs. Use scoping rules to focus on high-risk object types (CSV, JSON, Parquet) and exclude known-safe formats (compressed archives, binary files). De-identification must preserve data utility for analytics while removing re-identification risk.\n\n## Output Format\n\n```\nCloud DLP Compliance Report\n==============================\nOrganization: Acme Corp\nScan Period: 2026-02-01 to 2026-02-23\nEnvironments: AWS (12 buckets), GCP (3 datasets), Azure (5 storage accounts)\n\nDATA DISCOVERY SUMMARY:\n  Total objects\u002Frecords scanned:    2,847,000\n  Objects with sensitive data:        45,200 (1.6%)\n  Unique sensitivity categories:      8\n\nSENSITIVE DATA FINDINGS:\n  PII (names, emails, phone):       23,400 objects\n  Financial (credit cards, bank):     8,700 objects\n  Health (PHI, medical records):      3,200 objects\n  Credentials (API keys, tokens):     1,400 objects\n  Government ID (SSN, passport):      5,800 objects\n  Custom (employee ID, account):      2,700 objects\n\nFINDINGS BY SEVERITY:\n  Critical:    1,400 (exposed credentials)\n  High:       14,200 (unprotected PII\u002FPHI)\n  Medium:     18,600 (standard PII)\n  Low:        11,000 (non-sensitive patterns)\n\nPROTECTION STATUS:\n  Data with encryption at rest:       78%\n  Data with access controls:          65%\n  Data with sensitivity labels:       12%\n  Pipeline data with DLP gates:       30%\n\nREMEDIATION ACTIONS:\n  Objects quarantined:                1,400\n  De-identification applied:          8,200\n  Access controls tightened:         14,200\n  Sensitivity labels applied:        45,200\n```\n","# Implementing Cloud DLP for Data Protection\n\n## When to Use\n\n- When compliance frameworks (GDPR, HIPAA, PCI DSS) require automated sensitive data discovery and protection\n- When building data governance programs that classify and label data across cloud storage\n- When implementing data loss prevention controls for cloud-based data pipelines\n- When auditing cloud environments for unprotected sensitive data (PII, PHI, financial data)\n- When integrating DLP scanning into CI\u002FCD pipelines to prevent sensitive data from reaching production\n\n**Do not use** for endpoint DLP (use Microsoft Purview or Symantec DLP agents), for email DLP (use Microsoft 365 DLP or Google Workspace DLP), or for network-level data exfiltration prevention (use VPC endpoint policies and network firewalls).\n\n## Prerequisites\n\n- Amazon Macie enabled with appropriate S3 bucket permissions\n- Google Cloud DLP API enabled (`gcloud services enable dlp.googleapis.com`)\n- Azure Information Protection or Microsoft Purview configured\n- IAM permissions for DLP service administration and data access\n- Knowledge of data sensitivity categories relevant to the organization (PII, PHI, PCI, proprietary)\n\n## Workflow\n\n### Step 1: Deploy Amazon Macie for S3 Data Discovery\n\nEnable Macie and configure automated sensitive data discovery jobs for S3 buckets.\n\n```bash\n# Enable Amazon Macie\naws macie2 enable-macie\n\n# List all S3 buckets Macie can scan\naws macie2 describe-buckets \\\n  --query 'buckets[*].[bucketName,classifiableSizeInBytes,unclassifiableObjectCount.total]' \\\n  --output table\n\n# Create a classification job for specific buckets\naws macie2 create-classification-job \\\n  --job-type SCHEDULED \\\n  --name \"weekly-pii-scan\" \\\n  --schedule-frequency-details '{\"weekly\":{\"dayOfWeek\":\"MONDAY\"}}' \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"ACCOUNT_ID\",\n      \"buckets\": [\"customer-data-bucket\", \"analytics-data-lake\", \"backup-bucket\"]\n    }],\n    \"scoping\": {\n      \"includes\": {\n        \"and\": [{\n          \"simpleScopeTerm\": {\n            \"key\": \"OBJECT_EXTENSION\",\n            \"values\": [\"csv\", \"json\", \"parquet\", \"txt\", \"xlsx\"],\n            \"comparator\": \"EQ\"\n          }\n        }]\n      }\n    }\n  }' \\\n  --managed-data-identifier-ids '[\"SSN\",\"CREDIT_CARD_NUMBER\",\"EMAIL_ADDRESS\",\"AWS_CREDENTIALS\",\"PHONE_NUMBER\"]'\n\n# Create custom data identifier for internal employee IDs\naws macie2 create-custom-data-identifier \\\n  --name \"EmployeeID\" \\\n  --regex \"EMP-[0-9]{6}\" \\\n  --description \"Internal employee ID format\"\n\n# Check job status and results\naws macie2 list-classification-jobs \\\n  --query 'items[*].[name,jobStatus,statistics.approximateNumberOfObjectsToProcess]' \\\n  --output table\n```\n\n### Step 2: Configure Google Cloud DLP API for Data Inspection\n\nUse Google Cloud DLP to inspect and de-identify sensitive data across GCP resources.\n\n```bash\n# Inspect a Cloud Storage bucket for sensitive data\ngcloud dlp inspect-content \\\n  --content-type=TEXT_PLAIN \\\n  --min-likelihood=LIKELY \\\n  --info-types=PHONE_NUMBER,EMAIL_ADDRESS,CREDIT_CARD_NUMBER,US_SOCIAL_SECURITY_NUMBER \\\n  --storage-type=CLOUD_STORAGE \\\n  --gcs-uri=\"gs:\u002F\u002Fsensitive-data-bucket\u002Fdata\u002F*.csv\"\n\n# Create an inspection job for BigQuery\ncat > dlp-job.json \u003C\u003C 'EOF'\n{\n  \"inspectJob\": {\n    \"storageConfig\": {\n      \"bigQueryOptions\": {\n        \"tableReference\": {\n          \"projectId\": \"PROJECT_ID\",\n          \"datasetId\": \"customer_data\",\n          \"tableId\": \"transactions\"\n        },\n        \"sampleMethod\": \"RANDOM_START\",\n        \"rowsLimit\": 10000\n      }\n    },\n    \"inspectConfig\": {\n      \"infoTypes\": [\n        {\"name\": \"CREDIT_CARD_NUMBER\"},\n        {\"name\": \"US_SOCIAL_SECURITY_NUMBER\"},\n        {\"name\": \"EMAIL_ADDRESS\"},\n        {\"name\": \"PHONE_NUMBER\"},\n        {\"name\": \"PERSON_NAME\"}\n      ],\n      \"minLikelihood\": \"LIKELY\",\n      \"limits\": {\"maxFindingsPerRequest\": 1000}\n    },\n    \"actions\": [{\n      \"saveFindings\": {\n        \"outputConfig\": {\n          \"table\": {\n            \"projectId\": \"PROJECT_ID\",\n            \"datasetId\": \"dlp_results\",\n            \"tableId\": \"findings\"\n          }\n        }\n      }\n    }]\n  }\n}\nEOF\n\ngcloud dlp jobs create --project=PROJECT_ID --body-from-file=dlp-job.json\n```\n\n### Step 3: Implement Data De-identification with Cloud DLP\n\nConfigure de-identification transforms to mask, tokenize, or redact sensitive data.\n\n```python\n# deidentify_pipeline.py - De-identify sensitive data using Google Cloud DLP\nfrom google.cloud import dlp_v2\n\ndef deidentify_data(project_id, text):\n    \"\"\"De-identify PII in text using Cloud DLP.\"\"\"\n    client = dlp_v2.DlpServiceClient()\n\n    inspect_config = {\n        \"info_types\": [\n            {\"name\": \"EMAIL_ADDRESS\"},\n            {\"name\": \"PHONE_NUMBER\"},\n            {\"name\": \"CREDIT_CARD_NUMBER\"},\n            {\"name\": \"US_SOCIAL_SECURITY_NUMBER\"},\n        ],\n        \"min_likelihood\": dlp_v2.Likelihood.LIKELY,\n    }\n\n    deidentify_config = {\n        \"info_type_transformations\": {\n            \"transformations\": [\n                {\n                    \"info_types\": [{\"name\": \"EMAIL_ADDRESS\"}],\n                    \"primitive_transformation\": {\n                        \"character_mask_config\": {\n                            \"masking_character\": \"*\",\n                            \"number_to_mask\": 0,\n                            \"characters_to_ignore\": [\n                                {\"common_characters_to_ignore\": \"PUNCTUATION\"}\n                            ],\n                        }\n                    },\n                },\n                {\n                    \"info_types\": [{\"name\": \"CREDIT_CARD_NUMBER\"}],\n                    \"primitive_transformation\": {\n                        \"crypto_replace_ffx_fpe_config\": {\n                            \"crypto_key\": {\n                                \"kms_wrapped\": {\n                                    \"wrapped_key\": \"WRAPPED_KEY_BASE64\",\n                                    \"crypto_key_name\": \"projects\u002FPROJECT\u002Flocations\u002Fglobal\u002FkeyRings\u002Fdlp\u002FcryptoKeys\u002Ftokenization\",\n                                }\n                            },\n                            \"common_alphabet\": \"NUMERIC\",\n                        }\n                    },\n                },\n                {\n                    \"info_types\": [{\"name\": \"US_SOCIAL_SECURITY_NUMBER\"}],\n                    \"primitive_transformation\": {\n                        \"redact_config\": {}\n                    },\n                },\n            ]\n        }\n    }\n\n    item = {\"value\": text}\n    parent = f\"projects\u002F{project_id}\u002Flocations\u002Fglobal\"\n\n    response = client.deidentify_content(\n        request={\n            \"parent\": parent,\n            \"deidentify_config\": deidentify_config,\n            \"inspect_config\": inspect_config,\n            \"item\": item,\n        }\n    )\n    return response.item.value\n```\n\n### Step 4: Configure Azure Information Protection\n\nSet up sensitivity labels and DLP policies in Microsoft Purview for Azure resources.\n\n```powershell\n# Connect to Microsoft Purview compliance\nConnect-IPPSSession\n\n# Create sensitivity labels\nNew-Label -DisplayName \"Confidential - PII\" \\\n  -Name \"Confidential-PII\" \\\n  -Tooltip \"Contains personally identifiable information\" \\\n  -ContentType \"File, Email\"\n\nNew-Label -DisplayName \"Highly Confidential - Financial\" \\\n  -Name \"HighlyConfidential-Financial\" \\\n  -Tooltip \"Contains financial data subject to PCI DSS\" \\\n  -ContentType \"File, Email\"\n\n# Create auto-labeling policy for Azure Storage\nNew-AutoSensitivityLabelPolicy -Name \"Auto-Label-PII\" \\\n  -ExchangeLocation All \\\n  -SharePointLocation All \\\n  -OneDriveLocation All \\\n  -Mode Enable\n\nNew-AutoSensitivityLabelRule -Policy \"Auto-Label-PII\" \\\n  -Name \"Detect-SSN\" \\\n  -ContentContainsSensitiveInformation @{\n    Name = \"U.S. Social Security Number (SSN)\";\n    MinCount = 1;\n    MinConfidence = 85\n  } \\\n  -ApplySensitivityLabel \"Confidential-PII\"\n```\n\n```bash\n# Azure: Configure DLP policy for Storage accounts\naz security assessment create \\\n  --name \"storage-sensitive-data\" \\\n  --assessed-resource-type \"Microsoft.Storage\u002FstorageAccounts\"\n\n# Enable Microsoft Defender for Storage with sensitive data threat detection\naz security pricing create --name StorageAccounts --tier standard \\\n  --subplan DefenderForStorageV2 \\\n  --extensions '[{\"name\":\"SensitiveDataDiscovery\",\"isEnabled\":\"True\"}]'\n```\n\n### Step 5: Integrate DLP into Data Pipelines\n\nAdd DLP scanning to ETL and data pipeline workflows to prevent sensitive data leakage.\n\n```python\n# pipeline_dlp_gate.py - DLP gate for data pipelines\nimport boto3\nimport json\n\nmacie_client = boto3.client('macie2')\ns3_client = boto3.client('s3')\n\ndef scan_pipeline_output(bucket, prefix):\n    \"\"\"Scan pipeline output data for sensitive content before promotion.\"\"\"\n    job_response = macie_client.create_classification_job(\n        jobType='ONE_TIME',\n        name=f'pipeline-scan-{prefix}',\n        s3JobDefinition={\n            'bucketDefinitions': [{\n                'accountId': boto3.client('sts').get_caller_identity()['Account'],\n                'buckets': [bucket]\n            }],\n            'scoping': {\n                'includes': {\n                    'and': [{\n                        'simpleScopeTerm': {\n                            'key': 'OBJECT_KEY',\n                            'comparator': 'STARTS_WITH',\n                            'values': [prefix]\n                        }\n                    }]\n                }\n            }\n        },\n        managedDataIdentifierSelector='ALL'\n    )\n\n    return job_response['jobId']\n\ndef check_scan_results(job_id):\n    \"\"\"Check if DLP scan found sensitive data.\"\"\"\n    response = macie_client.list_findings(\n        findingCriteria={\n            'criterion': {\n                'classificationDetails.jobId': {'eq': [job_id]},\n                'severity.description': {'eq': ['High', 'Critical']}\n            }\n        }\n    )\n    return len(response.get('findingIds', [])) > 0\n\ndef gate_decision(bucket, prefix):\n    \"\"\"DLP gate: block pipeline if sensitive data found.\"\"\"\n    job_id = scan_pipeline_output(bucket, prefix)\n    has_sensitive_data = check_scan_results(job_id)\n\n    if has_sensitive_data:\n        return {\n            'decision': 'BLOCK',\n            'reason': 'Sensitive data detected in pipeline output',\n            'action': 'Apply de-identification before promoting to production'\n        }\n    return {'decision': 'ALLOW', 'reason': 'No sensitive data detected'}\n```\n\n### Step 6: Monitor DLP Findings and Generate Reports\n\nAggregate DLP findings across cloud providers and generate compliance reports.\n\n```bash\n# Macie: Get finding statistics\naws macie2 get-finding-statistics \\\n  --group-by \"severity.description\" \\\n  --finding-criteria '{\"criterion\":{\"category\":{\"eq\":[\"CLASSIFICATION\"]}}}'\n\n# Macie: List findings by sensitivity type\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"classificationDetails.result.sensitiveData.category\": {\"eq\": [\"PERSONAL_INFORMATION\"]},\n      \"severity.description\": {\"eq\": [\"High\"]}\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}'\n\n# GCP DLP: List job results\ngcloud dlp jobs list --project=PROJECT_ID --filter=\"state=DONE\" \\\n  --format=\"table(name, createTime, inspectDetails.result.processedBytes, inspectDetails.result.totalEstimatedTransformations)\"\n\n# Export Macie findings to S3 for compliance reporting\naws macie2 create-findings-report \\\n  --finding-criteria '{\"criterion\":{\"category\":{\"eq\":[\"CLASSIFICATION\"]}}}' \\\n  --sort-criteria '{\"attributeName\":\"severity.score\",\"orderBy\":\"DESC\"}'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Data Loss Prevention | Security controls and technologies that detect and prevent unauthorized disclosure of sensitive data from cloud environments |\n| Amazon Macie | AWS service using machine learning to discover, classify, and protect sensitive data stored in S3 buckets |\n| Google Cloud DLP | GCP API for inspecting, classifying, and de-identifying sensitive data across Cloud Storage, BigQuery, and Datastore |\n| Data De-identification | Transforming sensitive data using masking, tokenization, encryption, or redaction to remove identifying characteristics while preserving utility |\n| Sensitivity Label | Classification tag applied to data (Confidential, Highly Confidential) that triggers DLP policy enforcement and access controls |\n| Custom Data Identifier | Organization-specific pattern (regex or keyword) added to DLP services to detect proprietary sensitive data formats |\n\n## Tools & Systems\n\n- **Amazon Macie**: ML-powered sensitive data discovery and classification for S3 with automated finding generation\n- **Google Cloud DLP API**: Programmable API for inspecting, classifying, de-identifying, and redacting sensitive data\n- **Microsoft Purview**: Data governance platform with sensitivity labeling, auto-classification, and DLP policy enforcement\n- **Azure Information Protection**: Data classification and labeling service integrated with Microsoft 365 and Azure storage\n- **Nightfall AI**: Third-party cloud DLP tool supporting scanning across SaaS applications and cloud infrastructure\n\n## Common Scenarios\n\n### Scenario: Discovering PII in an Unprotected S3 Data Lake\n\n**Context**: A compliance audit reveals that the analytics team's S3 data lake contains customer PII (names, emails, SSNs) in CSV files without encryption or access controls. The organization must classify all data and implement DLP controls.\n\n**Approach**:\n1. Enable Macie and create a one-time classification job against the data lake bucket\n2. Review Macie findings to identify which objects contain PII and what types\n3. Create custom data identifiers for organization-specific formats (employee IDs, account numbers)\n4. Implement a weekly scheduled Macie job for ongoing discovery\n5. Build a data pipeline gate that scans new data before promotion to the data lake\n6. Apply de-identification transforms (masking SSNs, tokenizing emails) for analytics use cases\n7. Configure S3 bucket policies to restrict access to classified data to authorized roles only\n\n**Pitfalls**: Macie charges per GB scanned. Large data lakes can generate significant costs. Use scoping rules to focus on high-risk object types (CSV, JSON, Parquet) and exclude known-safe formats (compressed archives, binary files). De-identification must preserve data utility for analytics while removing re-identification risk.\n\n## Output Format\n\n```\nCloud DLP Compliance Report\n==============================\nOrganization: Acme Corp\nScan Period: 2026-02-01 to 2026-02-23\nEnvironments: AWS (12 buckets), GCP (3 datasets), Azure (5 storage accounts)\n\nDATA DISCOVERY SUMMARY:\n  Total objects\u002Frecords scanned:    2,847,000\n  Objects with sensitive data:        45,200 (1.6%)\n  Unique sensitivity categories:      8\n\nSENSITIVE DATA FINDINGS:\n  PII (names, emails, phone):       23,400 objects\n  Financial (credit cards, bank):     8,700 objects\n  Health (PHI, medical records):      3,200 objects\n  Credentials (API keys, tokens):     1,400 objects\n  Government ID (SSN, passport):      5,800 objects\n  Custom (employee ID, account):      2,700 objects\n\nFINDINGS BY SEVERITY:\n  Critical:    1,400 (exposed credentials)\n  High:       14,200 (unprotected PII\u002FPHI)\n  Medium:     18,600 (standard PII)\n  Low:        11,000 (non-sensitive patterns)\n\nPROTECTION STATUS:\n  Data with encryption at rest:       78%\n  Data with access controls:          65%\n  Data with sensitivity labels:       12%\n  Pipeline data with DLP gates:       30%\n\nREMEDIATION ACTIONS:\n  Objects quarantined:                1,400\n  De-identification applied:          8,200\n  Access controls tightened:         14,200\n  Sensitivity labels applied:        45,200\n```\n",{"name":5,"tags":63,"author":66,"domain":50,"license":15,"version":67,"nist_csf":68,"subdomain":47,"description":73,"nist_ai_rmf":74,"mitre_attack":80,"atlas_techniques":85},[47,40,64,53,55,65],"data-protection","privacy","mahipal","1.0",[69,70,71,72],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft Purview, Azure Information Protection, and Nightfall AI to discover, classify, label, de-identify, and protect sensitive data (PII, PHI, financial data) across cloud storage, databases, and pipelines. Use for GDPR\u002FHIPAA\u002FPCI DSS data-discovery, cloud data governance, or CI\u002FCD DLP scanning; not for endpoint, email, or network-level DLP.\n",[75,76,77,78,79],"MEASURE-2.7","MAP-5.1","MANAGE-2.4","MEASURE-2.8","MEASURE-2.9",[81,82,83,84],"T1078.004","T1530","T1537","T1580",[86,87,88],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-cloud-dlp-for-data-protection",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":100,"prompt":110,"zipAvailable":111},[101,104,107],{"tool":102,"command":103},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-dlp-for-data-protection",{"tool":105,"command":106},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-dlp-for-data-protection",{"tool":108,"command":109},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cloud-dlp-for-data-protection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-dlp-for-data-protection\u002FSKILL.md",true,[113,118,124],{"path":114,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-dlp-for-data-protection\u002FLICENSE",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fapi-reference.md","REFERENCE","参考文档",2179,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-dlp-for-data-protection\u002Freferences\u002Fapi-reference.md",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fagent.py","SCRIPT","脚本",7377,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cloud-dlp-for-data-protection\u002Fscripts\u002Fagent.py",[131,155,179,206,231,258],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":58},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[137],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,52,50,143,144,44,145,146,46,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":58},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,52,166,50,44,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":58},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,50,194,195,167,196,197,198,199,200,201,54,202,203,204,205],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":58},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[212],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,50,217,218,219,220,221,222,223,41,224,225,226,227,170,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":58},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,50,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":58},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[52,266,50,267,268,269,270,271,272,273,274,54,275,202,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]