[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF33WKQ81DR49CC7DTGZBD":3,"skill-same:01M6AF33WKQ81DR49CC7DTGZBD":135},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":94,"commitSha":95,"skillDirectory":96,"forksCount":97,"repositoryHtmlUrl":98,"repositoryHomepageUrl":99,"ownerHtmlUrl":100,"ownerBlogUrl":101,"ownerDescription":102,"updatedAt":103,"install":104,"resources":117},"01M6AF33WKQ81DR49CC7DTGZBD","implementing-delinea-secret-server-for-pam",null,"Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based access policies, automated password rotation, session recording, and Active Directory\u002Fcloud integration. Use when centralizing privileged credential management, replacing spreadsheet-based secrets, automating password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-delinea-secret-server-for-pam\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"implementing delinea secret server for pam","server","initial-access","password-vault","privileged-access","Secret-Server","Delinea","PAM","spreadsheet","credential-management","t1098","directory","t1078","t1003","reconnaissance","NIST","hipaa","pr","identity","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-delinea-secret-server-for-pam\ndescription: 'Implements Delinea Secret Server for privileged access management,\n  covering secret vault configuration, role-based access policies, automated password\n  rotation, session recording, and Active Directory\u002Fcloud integration. Use when centralizing\n  privileged credential management, replacing spreadsheet-based secrets, automating\n  password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).\n\n  '\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- PAM\n- Delinea\n- Secret-Server\n- privileged-access\n- password-vault\n- credential-management\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n- T1003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - initial-access\n  - positioning\n  techniques:\n  - id: T1555.005\n    name: 'Credentials from Password Stores: Password Managers'\n    tactic: reconnaissance\n    source: attack\n  - id: T1110\n    name: Brute Force\n    tactic: initial-access\n    source: attack\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n  - id: F1005\n    name: Account Manipulation\n    tactic: positioning\n    source: f3\n---\n\n# Implementing Delinea Secret Server for PAM\n\n## When to Use\n\n- Organization needs centralized privileged credential management across hybrid infrastructure\n- Compliance requirements mandate privileged access controls (SOX, PCI-DSS, HIPAA, NIST 800-53)\n- Service accounts and shared credentials are stored in spreadsheets or plaintext files\n- Need to implement automated password rotation for privileged accounts\n- Require session recording and keystroke logging for privileged user activity\n- Migrating from manual PAM processes to an enterprise vault solution\n\n**Do not use** for standard end-user password management; Delinea Secret Server is designed for privileged and shared account credential management requiring enterprise-grade controls.\n\n## Prerequisites\n\n- Delinea Secret Server license (On-Premises or Cloud)\n- Windows Server 2019\u002F2022 for on-premises deployment with IIS and SQL Server\n- Active Directory service account with read permissions for discovery\n- SSL\u002FTLS certificate for web interface encryption\n- Network connectivity to target systems for password rotation\n- PowerShell 5.1+ for automation scripts\n\n## Workflow\n\n### Step 1: Deploy Secret Server Infrastructure\n\nInstall and configure the Secret Server application server:\n\n```powershell\n# Pre-installation checks for on-premises deployment\n# Verify IIS is installed with required features\nImport-Module ServerManager\nInstall-WindowsFeature Web-Server, Web-Asp-Net45, Web-Windows-Auth, Web-Mgmt-Console\n\n# Verify SQL Server connectivity\n$sqlConn = New-Object System.Data.SqlClient.SqlConnection\n$sqlConn.ConnectionString = \"Server=sql01.corp.local;Database=master;Integrated Security=True\"\n$sqlConn.Open()\nWrite-Host \"SQL Server connection successful: $($sqlConn.ServerVersion)\"\n$sqlConn.Close()\n\n# Create Secret Server database\nInvoke-Sqlcmd -ServerInstance \"sql01.corp.local\" -Query @\"\nCREATE DATABASE SecretServer\nGO\nALTER DATABASE SecretServer SET RECOVERY FULL\nGO\n\"@\n\n# Download and run Secret Server installer\n# Navigate to https:\u002F\u002Fthy.center\u002Fss\u002Flink\u002FSSDownload for latest version\n# Run setup.exe and follow the installation wizard\n\n# Post-installation: Configure application pool\nImport-Module WebAdministration\nSet-ItemProperty \"IIS:\\AppPools\\SecretServer\" -Name processModel.identityType -Value SpecificUser\nSet-ItemProperty \"IIS:\\AppPools\\SecretServer\" -Name processModel.userName -Value \"CORP\\svc-secretserver\"\n```\n\n### Step 2: Configure Secret Templates and Folder Structure\n\nDefine secret templates and organize the vault hierarchy:\n\n```powershell\n# Connect to Secret Server API\n$baseUrl = \"https:\u002F\u002Fpam.corp.local\u002FSecretServer\"\n$creds = @{\n    username = \"ss-admin\"\n    password = $env:SS_ADMIN_PASSWORD\n    grant_type = \"password\"\n}\n$token = (Invoke-RestMethod \"$baseUrl\u002Foauth2\u002Ftoken\" -Method POST -Body $creds).access_token\n$headers = @{ Authorization = \"Bearer $token\" }\n\n# Create folder structure for organizing secrets\n$folders = @(\n    @{ folderName = \"Windows Servers\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Linux Servers\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Network Devices\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Cloud Accounts\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Service Accounts\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Database Accounts\"; parentFolderId = -1; inheritPermissions = $false }\n)\n\nforeach ($folder in $folders) {\n    Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Ffolders\" -Method POST -Headers $headers `\n        -ContentType \"application\u002Fjson\" -Body ($folder | ConvertTo-Json)\n}\n\n# Create custom secret template for database credentials\n$template = @{\n    name = \"Database Credential\"\n    fields = @(\n        @{ name = \"Server\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Port\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Database\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Username\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Password\"; isRequired = $true; fieldType = \"Password\" },\n        @{ name = \"Connection String\"; isRequired = $false; fieldType = \"Notes\" }\n    )\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecret-templates\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($template | ConvertTo-Json -Depth 3)\n```\n\n### Step 3: Configure Discovery and Account Onboarding\n\nSet up automated discovery of privileged accounts across the environment:\n\n```powershell\n# Configure Active Directory discovery source\n$adDiscovery = @{\n    name = \"Corporate AD Discovery\"\n    discoverySourceType = \"ActiveDirectory\"\n    active = $true\n    settings = @{\n        domainName = \"corp.local\"\n        friendlyName = \"Corporate Domain\"\n        discoveryAccountId = 12  # Service account secret ID\n        ouFilters = @(\n            \"OU=Servers,DC=corp,DC=local\",\n            \"OU=Workstations,DC=corp,DC=local\"\n        )\n    }\n    scanInterval = 86400  # 24 hours\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($adDiscovery | ConvertTo-Json -Depth 3)\n\n# Configure local account discovery for Windows servers\n$localDiscovery = @{\n    name = \"Windows Local Account Discovery\"\n    discoverySourceType = \"Machine\"\n    active = $true\n    settings = @{\n        machineType = \"Windows\"\n        accountScanTemplate = \"Windows Local Account\"\n        dependencyScanTemplate = \"Windows Service\"\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($localDiscovery | ConvertTo-Json -Depth 3)\n\n# Import discovered accounts as secrets\n# After discovery runs, review and import found accounts\n$discoveredAccounts = Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\u002Fstatus\" -Headers $headers\nWrite-Host \"Discovered $($discoveredAccounts.totalAccounts) accounts\"\nWrite-Host \"  - Domain Admins: $($discoveredAccounts.domainAdmins)\"\nWrite-Host \"  - Local Admins: $($discoveredAccounts.localAdmins)\"\nWrite-Host \"  - Service Accounts: $($discoveredAccounts.serviceAccounts)\"\n```\n\n### Step 4: Implement Password Rotation Policies\n\nConfigure automated password rotation with complexity requirements:\n\n```powershell\n# Create password rotation policy\n$rotationPolicy = @{\n    name = \"High-Security 30-Day Rotation\"\n    rotationIntervalDays = 30\n    passwordRequirements = @{\n        minimumLength = 24\n        maximumLength = 32\n        requireUpperCase = $true\n        requireLowerCase = $true\n        requireNumbers = $true\n        requireSymbols = $true\n        allowedSymbols = \"!@#$%^&*()-_=+[]{}|;:,.\u003C>?\"\n    }\n    rotationType = \"AutoChange\"\n    autoChangeSchedule = @{\n        changeType = \"RecurringSchedule\"\n        recurrenceType = \"Monthly\"\n        dayOfMonth = 1\n        startTime = \"02:00\"\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fremote-password-changing\u002Fconfiguration\" -Method POST `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($rotationPolicy | ConvertTo-Json -Depth 4)\n\n# Configure Remote Password Changing (RPC) for Windows accounts\n$rpcConfig = @{\n    secretId = 100  # Target secret\n    autoChangeEnabled = $true\n    autoChangeNextPassword = $true\n    privilegedAccountSecretId = 50  # Account used to perform the change\n    changePasswordUsing = \"PrivilegedAccount\"\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecrets\u002F100\u002Fremote-password-changing\" -Method PUT `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($rpcConfig | ConvertTo-Json)\n\n# Configure heartbeat monitoring to verify credential validity\n$heartbeat = @{\n    enabled = $true\n    intervalMinutes = 60\n    onFailure = \"SendAlert\"\n    alertEmailGroupId = 5\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecrets\u002F100\u002Fheartbeat\" -Method PUT `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($heartbeat | ConvertTo-Json)\n```\n\n### Step 5: Configure Session Recording and Monitoring\n\nEnable session recording for privileged access sessions:\n\n```powershell\n# Enable session recording policy\n$sessionPolicy = @{\n    name = \"Full Recording Policy\"\n    recordSessions = $true\n    recordKeystrokes = $true\n    recordApplications = $true\n    maxSessionDurationMinutes = 480\n    requireComment = $true\n    requireTicketNumber = $true\n    ticketSystemId = 1  # ServiceNow integration\n    settings = @{\n        videoCodec = \"H264\"\n        videoQuality = \"High\"\n        captureInterval = 1000  # milliseconds\n        storageLocation = \"\\\\\\\\fileserver\\\\SSRecordings\"\n        retentionDays = 365\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecret-policy\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($sessionPolicy | ConvertTo-Json -Depth 3)\n\n# Configure session launcher for RDP sessions\n$rdpLauncher = @{\n    launcherType = \"RDP\"\n    enableRecording = $true\n    enableDualControl = $true\n    approverGroupId = 10  # Security team group\n    connectAsSecretId = 100\n    settings = @{\n        useSSL = $true\n        restrictedEndpoints = @(\"192.168.1.0\u002F24\")\n        inactivityTimeout = 30  # minutes\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Flaunchers\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($rdpLauncher | ConvertTo-Json -Depth 3)\n\n# Configure dual control \u002F approval workflow\n$approvalWorkflow = @{\n    name = \"Tier-0 Account Approval\"\n    requireApproval = $true\n    approvers = @(\n        @{ groupId = 10; requiredApprovals = 1 }\n    )\n    accessRequestExpirationMinutes = 60\n    notifyOnApproval = $true\n    notifyOnDenial = $true\n}\n```\n\n### Step 6: Integrate with SIEM and Compliance Reporting\n\nConnect Secret Server events to security monitoring:\n\n```powershell\n# Configure Syslog forwarding to SIEM\n$syslogConfig = @{\n    enabled = $true\n    syslogServer = \"siem.corp.local\"\n    port = 514\n    protocol = \"TLS\"\n    facility = \"Auth\"\n    severity = \"Informational\"\n    events = @(\n        \"SecretView\", \"SecretEdit\", \"SecretCreate\", \"SecretDelete\",\n        \"PasswordChange\", \"PasswordChangeFailure\",\n        \"SessionStart\", \"SessionEnd\",\n        \"LoginFailure\", \"LoginSuccess\",\n        \"PermissionChange\", \"ApprovalRequest\"\n    )\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fconfiguration\u002Fsyslog\" -Method PUT -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($syslogConfig | ConvertTo-Json -Depth 2)\n\n# Generate compliance report\n$report = @{\n    reportType = \"PasswordCompliance\"\n    dateRange = @{\n        startDate = (Get-Date).AddDays(-30).ToString(\"yyyy-MM-dd\")\n        endDate = (Get-Date).ToString(\"yyyy-MM-dd\")\n    }\n    filters = @{\n        folderIds = @(1, 2, 3, 4, 5, 6)\n        includeSubFolders = $true\n    }\n}\n$reportResult = Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Freports\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($report | ConvertTo-Json -Depth 3)\n\n# Display compliance summary\nWrite-Host \"PAM Compliance Report\"\nWrite-Host \"=====================\"\nWrite-Host \"Total Secrets:         $($reportResult.totalSecrets)\"\nWrite-Host \"Rotation Compliant:    $($reportResult.rotationCompliant) ($($reportResult.rotationCompliancePct)%)\"\nWrite-Host \"Heartbeat Healthy:     $($reportResult.heartbeatHealthy) ($($reportResult.heartbeatHealthyPct)%)\"\nWrite-Host \"Password Age > 90d:    $($reportResult.passwordAgeViolations)\"\nWrite-Host \"Orphaned Accounts:     $($reportResult.orphanedAccounts)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Privileged Access Management (PAM)** | Security framework for controlling, monitoring, and auditing elevated access to critical systems and data through credential vaulting and session management |\n| **Secret** | A stored credential or sensitive data item in the vault, including passwords, SSH keys, API tokens, and certificates |\n| **Remote Password Changing (RPC)** | Automated mechanism that connects to target systems to rotate passwords according to defined policies without manual intervention |\n| **Heartbeat** | Periodic check that validates stored credentials against target systems to ensure vault contents remain synchronized and functional |\n| **Dual Control** | Security mechanism requiring approval from a second authorized user before granting access to highly sensitive secrets |\n| **Discovery** | Automated scanning of infrastructure to identify privileged accounts, service accounts, and dependencies across Active Directory, servers, and network devices |\n| **Session Recording** | Capture of complete privileged session activity including video, keystrokes, and application usage for audit and forensic review |\n\n## Tools & Systems\n\n- **Delinea Secret Server**: Enterprise PAM solution providing credential vaulting, password rotation, session recording, and privileged access workflows\n- **Delinea Distributed Engine**: Agent deployed in network segments to enable password changing and discovery across firewalled environments\n- **Secret Server REST API**: RESTful API for programmatic secret management, automation, and integration with DevOps pipelines\n- **Secret Server SDK**: .NET and PowerShell SDKs for application-level integration with Secret Server vault\n\n## Common Scenarios\n\n### Scenario: Migrating Shared Admin Credentials to Vault\n\n**Context**: An organization stores 500+ shared administrator credentials in Excel spreadsheets and password-protected documents. Auditors flagged this as a critical finding requiring remediation within 90 days.\n\n**Approach**:\n1. Deploy Secret Server with SQL Server backend and configure HTTPS access\n2. Design folder hierarchy mirroring the organizational structure (by department, system type, environment)\n3. Create secret templates matching the credential types in use (Windows, Linux, database, network device)\n4. Import existing credentials via CSV import or PowerShell bulk creation\n5. Configure discovery to find undocumented privileged accounts across AD and local systems\n6. Enable Remote Password Changing starting with non-production accounts to validate rotation\n7. Roll out session launchers to replace direct RDP\u002FSSH connections\n8. Gradually enable dual control for Tier-0 accounts (Domain Admins, root accounts)\n9. Configure SIEM integration and compliance reporting for audit evidence\n\n**Pitfalls**:\n- Not identifying all service account dependencies before enabling password rotation (causes service outages)\n- Enabling RPC for production accounts without testing in non-production first\n- Setting rotation intervals too short for service accounts that require coordinated restarts\n- Not configuring Distributed Engines for network segments separated by firewalls\n\n## Output Format\n\n```\nDELINEA SECRET SERVER PAM DEPLOYMENT REPORT\n=============================================\nEnvironment:       Hybrid (On-Premises + Azure)\nVersion:           Secret Server 11.6\nDeployment Mode:   On-Premises (High Availability)\n\nVAULT STATISTICS\nTotal Secrets:           1,247\n  Windows Credentials:   523\n  Linux\u002FSSH Keys:        312\n  Database Accounts:     198\n  Network Devices:       87\n  Cloud API Keys:        127\n\nPASSWORD ROTATION STATUS\nAuto-Change Enabled:     1,089 \u002F 1,247 (87.3%)\nRotation Compliant:      1,056 \u002F 1,089 (97.0%)\nHeartbeat Healthy:       1,198 \u002F 1,247 (96.1%)\nFailed Rotations (30d):  12\n\nSESSION MANAGEMENT\nActive Sessions:         23\nRecorded Sessions (30d): 4,567\nAverage Session Length:  22 minutes\nApproval Requests (30d): 189 (174 approved, 15 denied)\n\nDISCOVERY RESULTS\nScanned Systems:         2,340\nDiscovered Accounts:     3,891\nOnboarded to Vault:      1,247 (32.1%)\nPending Review:          892\n\nCOMPLIANCE\nSOX Controls Met:        12\u002F12\nPCI-DSS Requirements:    8\u002F8\nPassword Age Violations: 3 (remediation in progress)\n```\n","# Implementing Delinea Secret Server for PAM\n\n## When to Use\n\n- Organization needs centralized privileged credential management across hybrid infrastructure\n- Compliance requirements mandate privileged access controls (SOX, PCI-DSS, HIPAA, NIST 800-53)\n- Service accounts and shared credentials are stored in spreadsheets or plaintext files\n- Need to implement automated password rotation for privileged accounts\n- Require session recording and keystroke logging for privileged user activity\n- Migrating from manual PAM processes to an enterprise vault solution\n\n**Do not use** for standard end-user password management; Delinea Secret Server is designed for privileged and shared account credential management requiring enterprise-grade controls.\n\n## Prerequisites\n\n- Delinea Secret Server license (On-Premises or Cloud)\n- Windows Server 2019\u002F2022 for on-premises deployment with IIS and SQL Server\n- Active Directory service account with read permissions for discovery\n- SSL\u002FTLS certificate for web interface encryption\n- Network connectivity to target systems for password rotation\n- PowerShell 5.1+ for automation scripts\n\n## Workflow\n\n### Step 1: Deploy Secret Server Infrastructure\n\nInstall and configure the Secret Server application server:\n\n```powershell\n# Pre-installation checks for on-premises deployment\n# Verify IIS is installed with required features\nImport-Module ServerManager\nInstall-WindowsFeature Web-Server, Web-Asp-Net45, Web-Windows-Auth, Web-Mgmt-Console\n\n# Verify SQL Server connectivity\n$sqlConn = New-Object System.Data.SqlClient.SqlConnection\n$sqlConn.ConnectionString = \"Server=sql01.corp.local;Database=master;Integrated Security=True\"\n$sqlConn.Open()\nWrite-Host \"SQL Server connection successful: $($sqlConn.ServerVersion)\"\n$sqlConn.Close()\n\n# Create Secret Server database\nInvoke-Sqlcmd -ServerInstance \"sql01.corp.local\" -Query @\"\nCREATE DATABASE SecretServer\nGO\nALTER DATABASE SecretServer SET RECOVERY FULL\nGO\n\"@\n\n# Download and run Secret Server installer\n# Navigate to https:\u002F\u002Fthy.center\u002Fss\u002Flink\u002FSSDownload for latest version\n# Run setup.exe and follow the installation wizard\n\n# Post-installation: Configure application pool\nImport-Module WebAdministration\nSet-ItemProperty \"IIS:\\AppPools\\SecretServer\" -Name processModel.identityType -Value SpecificUser\nSet-ItemProperty \"IIS:\\AppPools\\SecretServer\" -Name processModel.userName -Value \"CORP\\svc-secretserver\"\n```\n\n### Step 2: Configure Secret Templates and Folder Structure\n\nDefine secret templates and organize the vault hierarchy:\n\n```powershell\n# Connect to Secret Server API\n$baseUrl = \"https:\u002F\u002Fpam.corp.local\u002FSecretServer\"\n$creds = @{\n    username = \"ss-admin\"\n    password = $env:SS_ADMIN_PASSWORD\n    grant_type = \"password\"\n}\n$token = (Invoke-RestMethod \"$baseUrl\u002Foauth2\u002Ftoken\" -Method POST -Body $creds).access_token\n$headers = @{ Authorization = \"Bearer $token\" }\n\n# Create folder structure for organizing secrets\n$folders = @(\n    @{ folderName = \"Windows Servers\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Linux Servers\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Network Devices\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Cloud Accounts\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Service Accounts\"; parentFolderId = -1; inheritPermissions = $false },\n    @{ folderName = \"Database Accounts\"; parentFolderId = -1; inheritPermissions = $false }\n)\n\nforeach ($folder in $folders) {\n    Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Ffolders\" -Method POST -Headers $headers `\n        -ContentType \"application\u002Fjson\" -Body ($folder | ConvertTo-Json)\n}\n\n# Create custom secret template for database credentials\n$template = @{\n    name = \"Database Credential\"\n    fields = @(\n        @{ name = \"Server\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Port\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Database\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Username\"; isRequired = $true; fieldType = \"Text\" },\n        @{ name = \"Password\"; isRequired = $true; fieldType = \"Password\" },\n        @{ name = \"Connection String\"; isRequired = $false; fieldType = \"Notes\" }\n    )\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecret-templates\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($template | ConvertTo-Json -Depth 3)\n```\n\n### Step 3: Configure Discovery and Account Onboarding\n\nSet up automated discovery of privileged accounts across the environment:\n\n```powershell\n# Configure Active Directory discovery source\n$adDiscovery = @{\n    name = \"Corporate AD Discovery\"\n    discoverySourceType = \"ActiveDirectory\"\n    active = $true\n    settings = @{\n        domainName = \"corp.local\"\n        friendlyName = \"Corporate Domain\"\n        discoveryAccountId = 12  # Service account secret ID\n        ouFilters = @(\n            \"OU=Servers,DC=corp,DC=local\",\n            \"OU=Workstations,DC=corp,DC=local\"\n        )\n    }\n    scanInterval = 86400  # 24 hours\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($adDiscovery | ConvertTo-Json -Depth 3)\n\n# Configure local account discovery for Windows servers\n$localDiscovery = @{\n    name = \"Windows Local Account Discovery\"\n    discoverySourceType = \"Machine\"\n    active = $true\n    settings = @{\n        machineType = \"Windows\"\n        accountScanTemplate = \"Windows Local Account\"\n        dependencyScanTemplate = \"Windows Service\"\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($localDiscovery | ConvertTo-Json -Depth 3)\n\n# Import discovered accounts as secrets\n# After discovery runs, review and import found accounts\n$discoveredAccounts = Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fdiscovery\u002Fstatus\" -Headers $headers\nWrite-Host \"Discovered $($discoveredAccounts.totalAccounts) accounts\"\nWrite-Host \"  - Domain Admins: $($discoveredAccounts.domainAdmins)\"\nWrite-Host \"  - Local Admins: $($discoveredAccounts.localAdmins)\"\nWrite-Host \"  - Service Accounts: $($discoveredAccounts.serviceAccounts)\"\n```\n\n### Step 4: Implement Password Rotation Policies\n\nConfigure automated password rotation with complexity requirements:\n\n```powershell\n# Create password rotation policy\n$rotationPolicy = @{\n    name = \"High-Security 30-Day Rotation\"\n    rotationIntervalDays = 30\n    passwordRequirements = @{\n        minimumLength = 24\n        maximumLength = 32\n        requireUpperCase = $true\n        requireLowerCase = $true\n        requireNumbers = $true\n        requireSymbols = $true\n        allowedSymbols = \"!@#$%^&*()-_=+[]{}|;:,.\u003C>?\"\n    }\n    rotationType = \"AutoChange\"\n    autoChangeSchedule = @{\n        changeType = \"RecurringSchedule\"\n        recurrenceType = \"Monthly\"\n        dayOfMonth = 1\n        startTime = \"02:00\"\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fremote-password-changing\u002Fconfiguration\" -Method POST `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($rotationPolicy | ConvertTo-Json -Depth 4)\n\n# Configure Remote Password Changing (RPC) for Windows accounts\n$rpcConfig = @{\n    secretId = 100  # Target secret\n    autoChangeEnabled = $true\n    autoChangeNextPassword = $true\n    privilegedAccountSecretId = 50  # Account used to perform the change\n    changePasswordUsing = \"PrivilegedAccount\"\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecrets\u002F100\u002Fremote-password-changing\" -Method PUT `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($rpcConfig | ConvertTo-Json)\n\n# Configure heartbeat monitoring to verify credential validity\n$heartbeat = @{\n    enabled = $true\n    intervalMinutes = 60\n    onFailure = \"SendAlert\"\n    alertEmailGroupId = 5\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecrets\u002F100\u002Fheartbeat\" -Method PUT `\n    -Headers $headers -ContentType \"application\u002Fjson\" -Body ($heartbeat | ConvertTo-Json)\n```\n\n### Step 5: Configure Session Recording and Monitoring\n\nEnable session recording for privileged access sessions:\n\n```powershell\n# Enable session recording policy\n$sessionPolicy = @{\n    name = \"Full Recording Policy\"\n    recordSessions = $true\n    recordKeystrokes = $true\n    recordApplications = $true\n    maxSessionDurationMinutes = 480\n    requireComment = $true\n    requireTicketNumber = $true\n    ticketSystemId = 1  # ServiceNow integration\n    settings = @{\n        videoCodec = \"H264\"\n        videoQuality = \"High\"\n        captureInterval = 1000  # milliseconds\n        storageLocation = \"\\\\\\\\fileserver\\\\SSRecordings\"\n        retentionDays = 365\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fsecret-policy\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($sessionPolicy | ConvertTo-Json -Depth 3)\n\n# Configure session launcher for RDP sessions\n$rdpLauncher = @{\n    launcherType = \"RDP\"\n    enableRecording = $true\n    enableDualControl = $true\n    approverGroupId = 10  # Security team group\n    connectAsSecretId = 100\n    settings = @{\n        useSSL = $true\n        restrictedEndpoints = @(\"192.168.1.0\u002F24\")\n        inactivityTimeout = 30  # minutes\n    }\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Flaunchers\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($rdpLauncher | ConvertTo-Json -Depth 3)\n\n# Configure dual control \u002F approval workflow\n$approvalWorkflow = @{\n    name = \"Tier-0 Account Approval\"\n    requireApproval = $true\n    approvers = @(\n        @{ groupId = 10; requiredApprovals = 1 }\n    )\n    accessRequestExpirationMinutes = 60\n    notifyOnApproval = $true\n    notifyOnDenial = $true\n}\n```\n\n### Step 6: Integrate with SIEM and Compliance Reporting\n\nConnect Secret Server events to security monitoring:\n\n```powershell\n# Configure Syslog forwarding to SIEM\n$syslogConfig = @{\n    enabled = $true\n    syslogServer = \"siem.corp.local\"\n    port = 514\n    protocol = \"TLS\"\n    facility = \"Auth\"\n    severity = \"Informational\"\n    events = @(\n        \"SecretView\", \"SecretEdit\", \"SecretCreate\", \"SecretDelete\",\n        \"PasswordChange\", \"PasswordChangeFailure\",\n        \"SessionStart\", \"SessionEnd\",\n        \"LoginFailure\", \"LoginSuccess\",\n        \"PermissionChange\", \"ApprovalRequest\"\n    )\n}\nInvoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Fconfiguration\u002Fsyslog\" -Method PUT -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($syslogConfig | ConvertTo-Json -Depth 2)\n\n# Generate compliance report\n$report = @{\n    reportType = \"PasswordCompliance\"\n    dateRange = @{\n        startDate = (Get-Date).AddDays(-30).ToString(\"yyyy-MM-dd\")\n        endDate = (Get-Date).ToString(\"yyyy-MM-dd\")\n    }\n    filters = @{\n        folderIds = @(1, 2, 3, 4, 5, 6)\n        includeSubFolders = $true\n    }\n}\n$reportResult = Invoke-RestMethod \"$baseUrl\u002Fapi\u002Fv1\u002Freports\" -Method POST -Headers $headers `\n    -ContentType \"application\u002Fjson\" -Body ($report | ConvertTo-Json -Depth 3)\n\n# Display compliance summary\nWrite-Host \"PAM Compliance Report\"\nWrite-Host \"=====================\"\nWrite-Host \"Total Secrets:         $($reportResult.totalSecrets)\"\nWrite-Host \"Rotation Compliant:    $($reportResult.rotationCompliant) ($($reportResult.rotationCompliancePct)%)\"\nWrite-Host \"Heartbeat Healthy:     $($reportResult.heartbeatHealthy) ($($reportResult.heartbeatHealthyPct)%)\"\nWrite-Host \"Password Age > 90d:    $($reportResult.passwordAgeViolations)\"\nWrite-Host \"Orphaned Accounts:     $($reportResult.orphanedAccounts)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Privileged Access Management (PAM)** | Security framework for controlling, monitoring, and auditing elevated access to critical systems and data through credential vaulting and session management |\n| **Secret** | A stored credential or sensitive data item in the vault, including passwords, SSH keys, API tokens, and certificates |\n| **Remote Password Changing (RPC)** | Automated mechanism that connects to target systems to rotate passwords according to defined policies without manual intervention |\n| **Heartbeat** | Periodic check that validates stored credentials against target systems to ensure vault contents remain synchronized and functional |\n| **Dual Control** | Security mechanism requiring approval from a second authorized user before granting access to highly sensitive secrets |\n| **Discovery** | Automated scanning of infrastructure to identify privileged accounts, service accounts, and dependencies across Active Directory, servers, and network devices |\n| **Session Recording** | Capture of complete privileged session activity including video, keystrokes, and application usage for audit and forensic review |\n\n## Tools & Systems\n\n- **Delinea Secret Server**: Enterprise PAM solution providing credential vaulting, password rotation, session recording, and privileged access workflows\n- **Delinea Distributed Engine**: Agent deployed in network segments to enable password changing and discovery across firewalled environments\n- **Secret Server REST API**: RESTful API for programmatic secret management, automation, and integration with DevOps pipelines\n- **Secret Server SDK**: .NET and PowerShell SDKs for application-level integration with Secret Server vault\n\n## Common Scenarios\n\n### Scenario: Migrating Shared Admin Credentials to Vault\n\n**Context**: An organization stores 500+ shared administrator credentials in Excel spreadsheets and password-protected documents. Auditors flagged this as a critical finding requiring remediation within 90 days.\n\n**Approach**:\n1. Deploy Secret Server with SQL Server backend and configure HTTPS access\n2. Design folder hierarchy mirroring the organizational structure (by department, system type, environment)\n3. Create secret templates matching the credential types in use (Windows, Linux, database, network device)\n4. Import existing credentials via CSV import or PowerShell bulk creation\n5. Configure discovery to find undocumented privileged accounts across AD and local systems\n6. Enable Remote Password Changing starting with non-production accounts to validate rotation\n7. Roll out session launchers to replace direct RDP\u002FSSH connections\n8. Gradually enable dual control for Tier-0 accounts (Domain Admins, root accounts)\n9. Configure SIEM integration and compliance reporting for audit evidence\n\n**Pitfalls**:\n- Not identifying all service account dependencies before enabling password rotation (causes service outages)\n- Enabling RPC for production accounts without testing in non-production first\n- Setting rotation intervals too short for service accounts that require coordinated restarts\n- Not configuring Distributed Engines for network segments separated by firewalls\n\n## Output Format\n\n```\nDELINEA SECRET SERVER PAM DEPLOYMENT REPORT\n=============================================\nEnvironment:       Hybrid (On-Premises + Azure)\nVersion:           Secret Server 11.6\nDeployment Mode:   On-Premises (High Availability)\n\nVAULT STATISTICS\nTotal Secrets:           1,247\n  Windows Credentials:   523\n  Linux\u002FSSH Keys:        312\n  Database Accounts:     198\n  Network Devices:       87\n  Cloud API Keys:        127\n\nPASSWORD ROTATION STATUS\nAuto-Change Enabled:     1,089 \u002F 1,247 (87.3%)\nRotation Compliant:      1,056 \u002F 1,089 (97.0%)\nHeartbeat Healthy:       1,198 \u002F 1,247 (96.1%)\nFailed Rotations (30d):  12\n\nSESSION MANAGEMENT\nActive Sessions:         23\nRecorded Sessions (30d): 4,567\nAverage Session Length:  22 minutes\nApproval Requests (30d): 189 (174 approved, 15 denied)\n\nDISCOVERY RESULTS\nScanned Systems:         2,340\nDiscovered Accounts:     3,891\nOnboarded to Vault:      1,247 (32.1%)\nPending Review:          892\n\nCOMPLIANCE\nSOX Controls Met:        12\u002F12\nPCI-DSS Requirements:    8\u002F8\nPassword Age Violations: 3 (remediation in progress)\n```\n",{"name":5,"tags":57,"author":58,"domain":51,"license":15,"version":59,"mitre_f3":60,"nist_csf":82,"subdomain":87,"description":88,"mitre_attack":89},[39,38,37,36,35,41],"mahipal","1.0",{"tactics":61,"version":63,"techniques":64},[46,34,62],"positioning","1.1",[65,69,72,76,79],{"id":66,"name":67,"source":68,"tactic":46},"T1555.005","Credentials from Password Stores: Password Managers","attack",{"id":70,"name":71,"source":68,"tactic":34},"T1110","Brute Force",{"id":73,"name":74,"source":75,"tactic":34},"F1006","Account Takeover","f3",{"id":77,"name":78,"source":75,"tactic":34},"F1006.002","Account Takeover: Exposed Login Credential",{"id":80,"name":81,"source":75,"tactic":62},"F1005","Account Manipulation",[83,84,85,86],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management","Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based access policies, automated password rotation, session recording, and Active Directory\u002Fcloud integration. Use when centralizing privileged credential management, replacing spreadsheet-based secrets, automating password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).\n",[90,70,91,92,93],"T1078","T1556","T1098","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-delinea-secret-server-for-pam",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":105,"prompt":115,"zipAvailable":116},[106,109,112],{"tool":107,"command":108},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-delinea-secret-server-for-pam",{"tool":110,"command":111},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-delinea-secret-server-for-pam",{"tool":113,"command":114},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-delinea-secret-server-for-pam","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-delinea-secret-server-for-pam\u002FSKILL.md",true,[118,123,129],{"path":119,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-delinea-secret-server-for-pam\u002FLICENSE",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fapi-reference.md","REFERENCE","参考文档",2330,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-delinea-secret-server-for-pam\u002Freferences\u002Fapi-reference.md",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fagent.py","SCRIPT","脚本",7204,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-delinea-secret-server-for-pam\u002Fscripts\u002Fagent.py",[136,161,185,212,238,265],{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[142],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[144,145,146,147,148,51,149,50,49,150,151,152,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,148,172,51,49,173,174,175,176,177,178,179,180,181,182,183,184],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[191,194],{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[179,196,197,198,199,51,200,201,173,202,203,204,205,206,207,44,208,209,210,211],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,221,222,51,223,224,225,226,227,228,229,230,231,232,233,234,176,235,236,237],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[244],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[246,247,248,51,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":266,"name":267,"nameZh":6,"description":268,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":269,"categories":270,"keywords":272,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[271],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,273,51,274,275,276,277,278,47,279,280,44,281,208,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]