[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF2XG4T51G6F34NK1PZGNB":3,"skill-same:01M6AF2XG4T51G6F34NK1PZGNB":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AF2XG4T51G6F34NK1PZGNB","implementing-ddos-mitigation-with-cloudflare",null,"Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ddos-mitigation-with-cloudflare\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"implementing ddos mitigation with cloudflare","cloudflare","network-security","volumetric-attack","layer-7","bot-management","ddos-mitigation","ddos","t1078","rate-limiting","bot","network","waf","protocol","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-ddos-mitigation-with-cloudflare\ndescription: Configure Cloudflare DDoS protection with managed rulesets, rate limiting,\n  WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol,\n  and application-layer attacks.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- ddos\n- cloudflare\n- ddos-mitigation\n- rate-limiting\n- waf\n- bot-management\n- layer-7\n- volumetric-attack\n- network-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1078.004\n---\n\n# Implementing DDoS Mitigation with Cloudflare\n\n## Overview\n\nCloudflare provides multi-layer DDoS protection across its global network of over 300 data centers with 477+ Tbps of capacity. The platform protects against L3\u002F4 volumetric attacks (SYN floods, UDP amplification, DNS reflection), protocol attacks (Ping of Death, Smurf), and L7 application-layer attacks (HTTP floods, Slowloris, cache-busting). Cloudflare's autonomous detection systems identify and mitigate attacks within approximately 3 seconds using traffic profiling, machine learning, and adaptive rulesets. This skill covers configuring Cloudflare's DDoS protection stack including managed rulesets, WAF rules, rate limiting, Bot Management, and origin server hardening.\n\n\n## When to Use\n\n- When deploying or configuring implementing ddos mitigation with cloudflare capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cloudflare account (Pro plan minimum for WAF, Enterprise for Advanced DDoS)\n- Domain with DNS delegated to Cloudflare nameservers\n- Origin server IP address(es)\n- Understanding of normal traffic patterns and peak volumes\n- Cloudflare API token for automation\n\n## Core Concepts\n\n### DDoS Attack Categories\n\n| Layer | Attack Type | Examples | Cloudflare Protection |\n|-------|------------|----------|----------------------|\n| L3\u002F4 | Volumetric | SYN flood, UDP flood, DNS amplification | Network-layer DDoS managed rules |\n| L3\u002F4 | Protocol | Ping of Death, Smurf, IP fragmentation | Advanced TCP Protection |\n| L7 | Application | HTTP flood, Slowloris, cache busting | HTTP DDoS managed rules, WAF, Rate Limiting |\n| DNS | DNS-specific | DNS query flood, NXDOMAIN attack | Advanced DNS Protection |\n\n### Cloudflare Protection Stack\n\n```\nInternet Traffic\n     │\n     ▼\n┌─────────────────────────┐\n│  Cloudflare Edge (PoP)  │\n│  ┌───────────────────┐  │\n│  │ L3\u002F4 DDoS Mgd Rules│  │  ← Volumetric\u002FProtocol mitigation\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ IP Access Rules    │  │  ← Country\u002FASN\u002FIP blocks\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ Bot Management     │  │  ← Bot score, JS challenge\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ WAF Managed Rules  │  │  ← OWASP, Cloudflare, Custom\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ Rate Limiting      │  │  ← Request rate enforcement\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ HTTP DDoS Mgd Rules│  │  ← L7 flood detection\n│  └───────────────────┘  │\n└─────────────────────────┘\n     │\n     ▼\n  Origin Server\n```\n\n## Workflow\n\n### Step 1: Onboard Domain to Cloudflare\n\n```bash\n# Add domain via API\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"example.com\",\n    \"type\": \"full\",\n    \"plan\": {\"id\": \"enterprise\"}\n  }'\n\n# Update DNS records (proxy enabled for DDoS protection)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"type\": \"A\",\n    \"name\": \"example.com\",\n    \"content\": \"203.0.113.50\",\n    \"proxied\": true,\n    \"ttl\": 1\n  }'\n```\n\n### Step 2: Configure DDoS Managed Rulesets\n\n**HTTP DDoS Attack Protection override:**\n\n```bash\n# List HTTP DDoS managed ruleset\ncurl -X GET \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fddos_l7\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\"\n\n# Override HTTP DDoS sensitivity and action\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fddos_l7\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [{\n      \"action\": \"execute\",\n      \"action_parameters\": {\n        \"id\": \"4d21379b4f9f4bb088e0729962c8b3cf\",\n        \"overrides\": {\n          \"rules\": [{\n            \"id\": \"fdfdac75430c4c47a422bdc024aab531\",\n            \"sensitivity_level\": \"medium\",\n            \"action\": \"block\"\n          }],\n          \"sensitivity_level\": \"high\"\n        }\n      },\n      \"expression\": \"true\"\n    }]\n  }'\n```\n\n**Network-layer DDoS Protection override:**\n\n```bash\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F$ACCOUNT_ID\u002Frulesets\u002Fphases\u002Fddos_l4\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [{\n      \"action\": \"execute\",\n      \"action_parameters\": {\n        \"id\": \"3b64149bfa6e4220bbbc2bd6db7c867e\",\n        \"overrides\": {\n          \"sensitivity_level\": \"high\"\n        }\n      },\n      \"expression\": \"true\"\n    }]\n  }'\n```\n\n### Step 3: Configure Rate Limiting Rules\n\n```bash\n# Create rate limiting rule for login endpoint\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fhttp_ratelimit\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [\n      {\n        \"description\": \"Rate limit login attempts\",\n        \"expression\": \"(http.request.uri.path eq \\\"\u002Fapi\u002Flogin\\\")\",\n        \"action\": \"block\",\n        \"ratelimit\": {\n          \"characteristics\": [\"cf.colo.id\", \"ip.src\"],\n          \"period\": 60,\n          \"requests_per_period\": 10,\n          \"mitigation_timeout\": 600\n        }\n      },\n      {\n        \"description\": \"Rate limit API endpoints\",\n        \"expression\": \"(http.request.uri.path matches \\\"^\u002Fapi\u002F\\\")\",\n        \"action\": \"managed_challenge\",\n        \"ratelimit\": {\n          \"characteristics\": [\"cf.colo.id\", \"ip.src\"],\n          \"period\": 60,\n          \"requests_per_period\": 100,\n          \"mitigation_timeout\": 300\n        }\n      },\n      {\n        \"description\": \"Global rate limit per IP\",\n        \"expression\": \"true\",\n        \"action\": \"managed_challenge\",\n        \"ratelimit\": {\n          \"characteristics\": [\"ip.src\"],\n          \"period\": 10,\n          \"requests_per_period\": 50,\n          \"mitigation_timeout\": 60\n        }\n      }\n    ]\n  }'\n```\n\n### Step 4: Configure WAF Custom Rules\n\n```bash\n# Block known attack patterns\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fhttp_request_firewall_custom\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [\n      {\n        \"description\": \"Block requests from known bad ASNs\",\n        \"expression\": \"(ip.geoip.asnum in {12345 67890})\",\n        \"action\": \"block\"\n      },\n      {\n        \"description\": \"Challenge requests without User-Agent\",\n        \"expression\": \"(not http.user_agent ne \\\"\\\")\",\n        \"action\": \"managed_challenge\"\n      },\n      {\n        \"description\": \"Block high-risk countries for admin paths\",\n        \"expression\": \"(http.request.uri.path contains \\\"\u002Fadmin\\\" and not ip.geoip.country in {\\\"US\\\" \\\"CA\\\" \\\"GB\\\"})\",\n        \"action\": \"block\"\n      },\n      {\n        \"description\": \"Block oversized request bodies\",\n        \"expression\": \"(http.request.body.size gt 10000000)\",\n        \"action\": \"block\"\n      }\n    ]\n  }'\n```\n\n### Step 5: Configure Origin Protection\n\nEnsure the origin server only accepts traffic from Cloudflare:\n\n```bash\n# Get Cloudflare IP ranges\ncurl https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fips\n\n# Configure origin server firewall (iptables)\n# Allow only Cloudflare IPs\nfor ip in $(curl -s https:\u002F\u002Fwww.cloudflare.com\u002Fips-v4); do\n    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT\n    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT\ndone\n\n# Drop all other HTTP\u002FHTTPS traffic\niptables -A INPUT -p tcp --dport 443 -j DROP\niptables -A INPUT -p tcp --dport 80 -j DROP\n\n# Enable Authenticated Origin Pulls (mutual TLS)\n# Download Cloudflare origin CA certificate\ncurl -o \u002Fetc\u002Fssl\u002Fcloudflare-origin-pull.pem \\\n  https:\u002F\u002Fdevelopers.cloudflare.com\u002Fssl\u002Fstatic\u002Fauthenticated_origin_pull_ca.pem\n\n# Nginx configuration for authenticated origin pulls\n# ssl_client_certificate \u002Fetc\u002Fssl\u002Fcloudflare-origin-pull.pem;\n# ssl_verify_client on;\n```\n\n### Step 6: Enable Under Attack Mode Automation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Auto-enable Cloudflare Under Attack Mode based on traffic anomalies.\"\"\"\n\nimport requests\nimport time\nimport sys\n\nCF_API_TOKEN = \"your-api-token\"\nZONE_ID = \"your-zone-id\"\nHEADERS = {\n    \"Authorization\": f\"Bearer {CF_API_TOKEN}\",\n    \"Content-Type\": \"application\u002Fjson\",\n}\nBASE_URL = f\"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F{ZONE_ID}\"\n\nNORMAL_RPS_THRESHOLD = 5000  # Requests per second threshold\nCHECK_INTERVAL = 30  # Seconds between checks\n\n\ndef get_current_security_level():\n    \"\"\"Get current security level setting.\"\"\"\n    resp = requests.get(\n        f\"{BASE_URL}\u002Fsettings\u002Fsecurity_level\",\n        headers=HEADERS\n    )\n    return resp.json()[\"result\"][\"value\"]\n\n\ndef set_security_level(level: str):\n    \"\"\"Set security level (off, essentially_off, low, medium, high, under_attack).\"\"\"\n    resp = requests.patch(\n        f\"{BASE_URL}\u002Fsettings\u002Fsecurity_level\",\n        headers=HEADERS,\n        json={\"value\": level}\n    )\n    result = resp.json()\n    if result[\"success\"]:\n        print(f\"[+] Security level set to: {level}\")\n    else:\n        print(f\"[-] Failed to set security level: {result['errors']}\")\n    return result[\"success\"]\n\n\ndef get_traffic_analytics():\n    \"\"\"Get recent traffic data from Cloudflare analytics.\"\"\"\n    query = \"\"\"\n    query {\n      viewer {\n        zones(filter: {zoneTag: \"%s\"}) {\n          httpRequests1mGroups(limit: 1, orderBy: [datetime_DESC]) {\n            sum {\n              requests\n              threats\n            }\n            dimensions {\n              datetime\n            }\n          }\n        }\n      }\n    }\n    \"\"\" % ZONE_ID\n\n    resp = requests.post(\n        \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fgraphql\",\n        headers=HEADERS,\n        json={\"query\": query}\n    )\n    return resp.json()\n\n\ndef monitor_and_respond():\n    \"\"\"Monitor traffic and auto-enable under attack mode.\"\"\"\n    current_level = get_current_security_level()\n    print(f\"[*] Current security level: {current_level}\")\n    print(f\"[*] Monitoring traffic (threshold: {NORMAL_RPS_THRESHOLD} RPS)...\")\n\n    attack_mode_active = False\n    consecutive_normal = 0\n\n    while True:\n        try:\n            analytics = get_traffic_analytics()\n            zones = analytics.get(\"data\", {}).get(\"viewer\", {}).get(\"zones\", [])\n\n            if zones and zones[0].get(\"httpRequests1mGroups\"):\n                data = zones[0][\"httpRequests1mGroups\"][0][\"sum\"]\n                rps = data[\"requests\"] \u002F 60\n                threats = data[\"threats\"]\n\n                print(f\"[*] Current RPS: {rps:.0f}, Threats: {threats}\")\n\n                if rps > NORMAL_RPS_THRESHOLD and not attack_mode_active:\n                    print(f\"[!] Traffic spike detected: {rps:.0f} RPS\")\n                    set_security_level(\"under_attack\")\n                    attack_mode_active = True\n                    consecutive_normal = 0\n\n                elif rps \u003C= NORMAL_RPS_THRESHOLD and attack_mode_active:\n                    consecutive_normal += 1\n                    if consecutive_normal >= 5:\n                        print(\"[+] Traffic normalized, disabling under attack mode\")\n                        set_security_level(\"high\")\n                        attack_mode_active = False\n                        consecutive_normal = 0\n\n        except Exception as e:\n            print(f\"[-] Error: {e}\")\n\n        time.sleep(CHECK_INTERVAL)\n\n\nif __name__ == \"__main__\":\n    monitor_and_respond()\n```\n\n## Monitoring and Alerting\n\n### Cloudflare Dashboard Metrics\n\n- **Firewall Events** - View blocked requests, challenged requests, rate-limited requests\n- **DDoS Analytics** - Attack size, duration, type, and mitigation status\n- **Traffic Analytics** - Request volume, bandwidth, error rates by time\n- **Bot Analytics** - Bot score distribution, verified bots vs automated threats\n\n### Alert Configuration\n\n```bash\n# Create notification policy for DDoS attacks\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F$ACCOUNT_ID\u002Falerting\u002Fv3\u002Fpolicies\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"DDoS Attack Alert\",\n    \"alert_type\": \"dos_attack_l7\",\n    \"enabled\": true,\n    \"mechanisms\": {\n      \"email\": [{\"id\": \"soc@example.com\"}],\n      \"webhooks\": [{\"id\": \"webhook-id\"}]\n    },\n    \"filters\": {\n      \"zones\": [\"'$ZONE_ID'\"]\n    }\n  }'\n```\n\n## Best Practices\n\n- **Proxy All DNS Records** - Ensure all A\u002FAAAA\u002FCNAME records pointing to origin are proxied (orange cloud)\n- **Hide Origin IP** - Never expose origin server IP; use Cloudflare Tunnel or restrict to Cloudflare IPs only\n- **Start in Log Mode** - Test DDoS rule overrides with \"Log\" action before switching to \"Block\"\n- **Layer Defense** - Combine managed rulesets, rate limiting, WAF rules, and Bot Management\n- **Tune Sensitivity** - Adjust DDoS rule sensitivity based on false positive rates in your traffic\n- **Cache Strategy** - Maximize cache hit ratio to reduce origin load during attacks\n- **Waiting Room** - Configure Cloudflare Waiting Room for critical pages during traffic surges\n- **Authenticated Origin** - Enable Authenticated Origin Pulls to prevent direct-to-origin attacks\n\n## References\n\n- [Cloudflare DDoS Protection Documentation](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fddos-protection\u002F)\n- [Cloudflare WAF Documentation](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002F)\n- [Cloudflare Rate Limiting](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Frate-limiting-rules\u002F)\n- [Cloudflare IP Ranges](https:\u002F\u002Fwww.cloudflare.com\u002Fips\u002F)\n","# Implementing DDoS Mitigation with Cloudflare\n\n## Overview\n\nCloudflare provides multi-layer DDoS protection across its global network of over 300 data centers with 477+ Tbps of capacity. The platform protects against L3\u002F4 volumetric attacks (SYN floods, UDP amplification, DNS reflection), protocol attacks (Ping of Death, Smurf), and L7 application-layer attacks (HTTP floods, Slowloris, cache-busting). Cloudflare's autonomous detection systems identify and mitigate attacks within approximately 3 seconds using traffic profiling, machine learning, and adaptive rulesets. This skill covers configuring Cloudflare's DDoS protection stack including managed rulesets, WAF rules, rate limiting, Bot Management, and origin server hardening.\n\n\n## When to Use\n\n- When deploying or configuring implementing ddos mitigation with cloudflare capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cloudflare account (Pro plan minimum for WAF, Enterprise for Advanced DDoS)\n- Domain with DNS delegated to Cloudflare nameservers\n- Origin server IP address(es)\n- Understanding of normal traffic patterns and peak volumes\n- Cloudflare API token for automation\n\n## Core Concepts\n\n### DDoS Attack Categories\n\n| Layer | Attack Type | Examples | Cloudflare Protection |\n|-------|------------|----------|----------------------|\n| L3\u002F4 | Volumetric | SYN flood, UDP flood, DNS amplification | Network-layer DDoS managed rules |\n| L3\u002F4 | Protocol | Ping of Death, Smurf, IP fragmentation | Advanced TCP Protection |\n| L7 | Application | HTTP flood, Slowloris, cache busting | HTTP DDoS managed rules, WAF, Rate Limiting |\n| DNS | DNS-specific | DNS query flood, NXDOMAIN attack | Advanced DNS Protection |\n\n### Cloudflare Protection Stack\n\n```\nInternet Traffic\n     │\n     ▼\n┌─────────────────────────┐\n│  Cloudflare Edge (PoP)  │\n│  ┌───────────────────┐  │\n│  │ L3\u002F4 DDoS Mgd Rules│  │  ← Volumetric\u002FProtocol mitigation\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ IP Access Rules    │  │  ← Country\u002FASN\u002FIP blocks\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ Bot Management     │  │  ← Bot score, JS challenge\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ WAF Managed Rules  │  │  ← OWASP, Cloudflare, Custom\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ Rate Limiting      │  │  ← Request rate enforcement\n│  └───────────────────┘  │\n│  ┌───────────────────┐  │\n│  │ HTTP DDoS Mgd Rules│  │  ← L7 flood detection\n│  └───────────────────┘  │\n└─────────────────────────┘\n     │\n     ▼\n  Origin Server\n```\n\n## Workflow\n\n### Step 1: Onboard Domain to Cloudflare\n\n```bash\n# Add domain via API\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"example.com\",\n    \"type\": \"full\",\n    \"plan\": {\"id\": \"enterprise\"}\n  }'\n\n# Update DNS records (proxy enabled for DDoS protection)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"type\": \"A\",\n    \"name\": \"example.com\",\n    \"content\": \"203.0.113.50\",\n    \"proxied\": true,\n    \"ttl\": 1\n  }'\n```\n\n### Step 2: Configure DDoS Managed Rulesets\n\n**HTTP DDoS Attack Protection override:**\n\n```bash\n# List HTTP DDoS managed ruleset\ncurl -X GET \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fddos_l7\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\"\n\n# Override HTTP DDoS sensitivity and action\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fddos_l7\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [{\n      \"action\": \"execute\",\n      \"action_parameters\": {\n        \"id\": \"4d21379b4f9f4bb088e0729962c8b3cf\",\n        \"overrides\": {\n          \"rules\": [{\n            \"id\": \"fdfdac75430c4c47a422bdc024aab531\",\n            \"sensitivity_level\": \"medium\",\n            \"action\": \"block\"\n          }],\n          \"sensitivity_level\": \"high\"\n        }\n      },\n      \"expression\": \"true\"\n    }]\n  }'\n```\n\n**Network-layer DDoS Protection override:**\n\n```bash\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F$ACCOUNT_ID\u002Frulesets\u002Fphases\u002Fddos_l4\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [{\n      \"action\": \"execute\",\n      \"action_parameters\": {\n        \"id\": \"3b64149bfa6e4220bbbc2bd6db7c867e\",\n        \"overrides\": {\n          \"sensitivity_level\": \"high\"\n        }\n      },\n      \"expression\": \"true\"\n    }]\n  }'\n```\n\n### Step 3: Configure Rate Limiting Rules\n\n```bash\n# Create rate limiting rule for login endpoint\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fhttp_ratelimit\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [\n      {\n        \"description\": \"Rate limit login attempts\",\n        \"expression\": \"(http.request.uri.path eq \\\"\u002Fapi\u002Flogin\\\")\",\n        \"action\": \"block\",\n        \"ratelimit\": {\n          \"characteristics\": [\"cf.colo.id\", \"ip.src\"],\n          \"period\": 60,\n          \"requests_per_period\": 10,\n          \"mitigation_timeout\": 600\n        }\n      },\n      {\n        \"description\": \"Rate limit API endpoints\",\n        \"expression\": \"(http.request.uri.path matches \\\"^\u002Fapi\u002F\\\")\",\n        \"action\": \"managed_challenge\",\n        \"ratelimit\": {\n          \"characteristics\": [\"cf.colo.id\", \"ip.src\"],\n          \"period\": 60,\n          \"requests_per_period\": 100,\n          \"mitigation_timeout\": 300\n        }\n      },\n      {\n        \"description\": \"Global rate limit per IP\",\n        \"expression\": \"true\",\n        \"action\": \"managed_challenge\",\n        \"ratelimit\": {\n          \"characteristics\": [\"ip.src\"],\n          \"period\": 10,\n          \"requests_per_period\": 50,\n          \"mitigation_timeout\": 60\n        }\n      }\n    ]\n  }'\n```\n\n### Step 4: Configure WAF Custom Rules\n\n```bash\n# Block known attack patterns\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Frulesets\u002Fphases\u002Fhttp_request_firewall_custom\u002Fentrypoint\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"rules\": [\n      {\n        \"description\": \"Block requests from known bad ASNs\",\n        \"expression\": \"(ip.geoip.asnum in {12345 67890})\",\n        \"action\": \"block\"\n      },\n      {\n        \"description\": \"Challenge requests without User-Agent\",\n        \"expression\": \"(not http.user_agent ne \\\"\\\")\",\n        \"action\": \"managed_challenge\"\n      },\n      {\n        \"description\": \"Block high-risk countries for admin paths\",\n        \"expression\": \"(http.request.uri.path contains \\\"\u002Fadmin\\\" and not ip.geoip.country in {\\\"US\\\" \\\"CA\\\" \\\"GB\\\"})\",\n        \"action\": \"block\"\n      },\n      {\n        \"description\": \"Block oversized request bodies\",\n        \"expression\": \"(http.request.body.size gt 10000000)\",\n        \"action\": \"block\"\n      }\n    ]\n  }'\n```\n\n### Step 5: Configure Origin Protection\n\nEnsure the origin server only accepts traffic from Cloudflare:\n\n```bash\n# Get Cloudflare IP ranges\ncurl https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fips\n\n# Configure origin server firewall (iptables)\n# Allow only Cloudflare IPs\nfor ip in $(curl -s https:\u002F\u002Fwww.cloudflare.com\u002Fips-v4); do\n    iptables -A INPUT -p tcp --dport 443 -s $ip -j ACCEPT\n    iptables -A INPUT -p tcp --dport 80 -s $ip -j ACCEPT\ndone\n\n# Drop all other HTTP\u002FHTTPS traffic\niptables -A INPUT -p tcp --dport 443 -j DROP\niptables -A INPUT -p tcp --dport 80 -j DROP\n\n# Enable Authenticated Origin Pulls (mutual TLS)\n# Download Cloudflare origin CA certificate\ncurl -o \u002Fetc\u002Fssl\u002Fcloudflare-origin-pull.pem \\\n  https:\u002F\u002Fdevelopers.cloudflare.com\u002Fssl\u002Fstatic\u002Fauthenticated_origin_pull_ca.pem\n\n# Nginx configuration for authenticated origin pulls\n# ssl_client_certificate \u002Fetc\u002Fssl\u002Fcloudflare-origin-pull.pem;\n# ssl_verify_client on;\n```\n\n### Step 6: Enable Under Attack Mode Automation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Auto-enable Cloudflare Under Attack Mode based on traffic anomalies.\"\"\"\n\nimport requests\nimport time\nimport sys\n\nCF_API_TOKEN = \"your-api-token\"\nZONE_ID = \"your-zone-id\"\nHEADERS = {\n    \"Authorization\": f\"Bearer {CF_API_TOKEN}\",\n    \"Content-Type\": \"application\u002Fjson\",\n}\nBASE_URL = f\"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F{ZONE_ID}\"\n\nNORMAL_RPS_THRESHOLD = 5000  # Requests per second threshold\nCHECK_INTERVAL = 30  # Seconds between checks\n\n\ndef get_current_security_level():\n    \"\"\"Get current security level setting.\"\"\"\n    resp = requests.get(\n        f\"{BASE_URL}\u002Fsettings\u002Fsecurity_level\",\n        headers=HEADERS\n    )\n    return resp.json()[\"result\"][\"value\"]\n\n\ndef set_security_level(level: str):\n    \"\"\"Set security level (off, essentially_off, low, medium, high, under_attack).\"\"\"\n    resp = requests.patch(\n        f\"{BASE_URL}\u002Fsettings\u002Fsecurity_level\",\n        headers=HEADERS,\n        json={\"value\": level}\n    )\n    result = resp.json()\n    if result[\"success\"]:\n        print(f\"[+] Security level set to: {level}\")\n    else:\n        print(f\"[-] Failed to set security level: {result['errors']}\")\n    return result[\"success\"]\n\n\ndef get_traffic_analytics():\n    \"\"\"Get recent traffic data from Cloudflare analytics.\"\"\"\n    query = \"\"\"\n    query {\n      viewer {\n        zones(filter: {zoneTag: \"%s\"}) {\n          httpRequests1mGroups(limit: 1, orderBy: [datetime_DESC]) {\n            sum {\n              requests\n              threats\n            }\n            dimensions {\n              datetime\n            }\n          }\n        }\n      }\n    }\n    \"\"\" % ZONE_ID\n\n    resp = requests.post(\n        \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fgraphql\",\n        headers=HEADERS,\n        json={\"query\": query}\n    )\n    return resp.json()\n\n\ndef monitor_and_respond():\n    \"\"\"Monitor traffic and auto-enable under attack mode.\"\"\"\n    current_level = get_current_security_level()\n    print(f\"[*] Current security level: {current_level}\")\n    print(f\"[*] Monitoring traffic (threshold: {NORMAL_RPS_THRESHOLD} RPS)...\")\n\n    attack_mode_active = False\n    consecutive_normal = 0\n\n    while True:\n        try:\n            analytics = get_traffic_analytics()\n            zones = analytics.get(\"data\", {}).get(\"viewer\", {}).get(\"zones\", [])\n\n            if zones and zones[0].get(\"httpRequests1mGroups\"):\n                data = zones[0][\"httpRequests1mGroups\"][0][\"sum\"]\n                rps = data[\"requests\"] \u002F 60\n                threats = data[\"threats\"]\n\n                print(f\"[*] Current RPS: {rps:.0f}, Threats: {threats}\")\n\n                if rps > NORMAL_RPS_THRESHOLD and not attack_mode_active:\n                    print(f\"[!] Traffic spike detected: {rps:.0f} RPS\")\n                    set_security_level(\"under_attack\")\n                    attack_mode_active = True\n                    consecutive_normal = 0\n\n                elif rps \u003C= NORMAL_RPS_THRESHOLD and attack_mode_active:\n                    consecutive_normal += 1\n                    if consecutive_normal >= 5:\n                        print(\"[+] Traffic normalized, disabling under attack mode\")\n                        set_security_level(\"high\")\n                        attack_mode_active = False\n                        consecutive_normal = 0\n\n        except Exception as e:\n            print(f\"[-] Error: {e}\")\n\n        time.sleep(CHECK_INTERVAL)\n\n\nif __name__ == \"__main__\":\n    monitor_and_respond()\n```\n\n## Monitoring and Alerting\n\n### Cloudflare Dashboard Metrics\n\n- **Firewall Events** - View blocked requests, challenged requests, rate-limited requests\n- **DDoS Analytics** - Attack size, duration, type, and mitigation status\n- **Traffic Analytics** - Request volume, bandwidth, error rates by time\n- **Bot Analytics** - Bot score distribution, verified bots vs automated threats\n\n### Alert Configuration\n\n```bash\n# Create notification policy for DDoS attacks\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F$ACCOUNT_ID\u002Falerting\u002Fv3\u002Fpolicies\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"DDoS Attack Alert\",\n    \"alert_type\": \"dos_attack_l7\",\n    \"enabled\": true,\n    \"mechanisms\": {\n      \"email\": [{\"id\": \"soc@example.com\"}],\n      \"webhooks\": [{\"id\": \"webhook-id\"}]\n    },\n    \"filters\": {\n      \"zones\": [\"'$ZONE_ID'\"]\n    }\n  }'\n```\n\n## Best Practices\n\n- **Proxy All DNS Records** - Ensure all A\u002FAAAA\u002FCNAME records pointing to origin are proxied (orange cloud)\n- **Hide Origin IP** - Never expose origin server IP; use Cloudflare Tunnel or restrict to Cloudflare IPs only\n- **Start in Log Mode** - Test DDoS rule overrides with \"Log\" action before switching to \"Block\"\n- **Layer Defense** - Combine managed rulesets, rate limiting, WAF rules, and Bot Management\n- **Tune Sensitivity** - Adjust DDoS rule sensitivity based on false positive rates in your traffic\n- **Cache Strategy** - Maximize cache hit ratio to reduce origin load during attacks\n- **Waiting Room** - Configure Cloudflare Waiting Room for critical pages during traffic surges\n- **Authenticated Origin** - Enable Authenticated Origin Pulls to prevent direct-to-origin attacks\n\n## References\n\n- [Cloudflare DDoS Protection Documentation](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fddos-protection\u002F)\n- [Cloudflare WAF Documentation](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002F)\n- [Cloudflare Rate Limiting](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Frate-limiting-rules\u002F)\n- [Cloudflare IP Ranges](https:\u002F\u002Fwww.cloudflare.com\u002Fips\u002F)\n",{"name":5,"tags":46,"author":47,"domain":39,"license":15,"version":48,"nist_csf":49,"subdomain":26,"description":7,"mitre_attack":54},[31,25,30,33,36,29,28,27,26],"mahipal","1.0",[50,51,52,53],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[55,56,57,58,59],"T1046","T1040","T1557","T1071","T1078.004","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-ddos-mitigation-with-cloudflare",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ddos-mitigation-with-cloudflare",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ddos-mitigation-with-cloudflare",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-ddos-mitigation-with-cloudflare","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ddos-mitigation-with-cloudflare\u002FSKILL.md",true,[84,89,95],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ddos-mitigation-with-cloudflare\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",1588,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ddos-mitigation-with-cloudflare\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",4714,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-ddos-mitigation-with-cloudflare\u002Fscripts\u002Fagent.py",[102,127,151,178,204,231],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,40,39,114,115,38,116,117,118,119,120,121,122,123,124,125,126],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,123,136,137,40,138,39,38,139,140,141,142,143,144,145,146,147,148,149,150],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,162,163,164,165,39,166,167,139,168,169,170,171,172,173,32,174,175,176,177],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,39,189,190,191,192,193,194,195,196,197,198,199,200,142,201,202,203],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,39,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,239,39,240,241,242,243,244,245,246,247,32,248,174,249,250,251,252,253,254],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]