[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF37B3CZAV53BYWFEZPPEJ":3,"skill-same:01M6AF37B3CZAV53BYWFEZPPEJ":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AF37B3CZAV53BYWFEZPPEJ","implementing-device-posture-assessment-in-zero-trust",null,"Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting access. Use when requiring device health checks before app access, wiring posture signals into conditional access, or implementing the CISA Zero Trust device pillar.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"implementing device posture assessment in zero trust","assessment","ZeRO","device-posture","jamf","intune","crowdstrike-zta","endpoint-compliance","t1059","t1078","CrowdStrike","endpoint","cybersecurity","zero-trust","CISA","conditional-access","compliance","pr","architecture","microsoft","2026-11-10 10:12:30",false,"---\nname: implementing-device-posture-assessment-in-zero-trust\ndescription: 'Implements device posture assessment as a zero trust access control\n  by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and\n  Jamf into conditional access policies that enforce compliance before granting access.\n  Use when requiring device health checks before app access, wiring posture signals\n  into conditional access, or implementing the CISA Zero Trust device pillar.\n\n  '\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- device-posture\n- zero-trust\n- endpoint-compliance\n- crowdstrike-zta\n- intune\n- conditional-access\n- jamf\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n---\n\n# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n","# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n",{"name":5,"tags":54,"author":55,"domain":41,"license":15,"version":56,"nist_csf":57,"subdomain":62,"description":63,"mitre_attack":64},[32,42,36,35,34,44,33],"mahipal","1.0",[58,59,60,61],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting access. Use when requiring device health checks before app access, wiring posture signals into conditional access, or implementing the CISA Zero Trust device pillar.\n",[65,66,67],"T1078","T1190","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-device-posture-assessment-in-zero-trust",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-device-posture-assessment-in-zero-trust",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-device-posture-assessment-in-zero-trust",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-device-posture-assessment-in-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",4413,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1528,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2232,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",3307,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",6830,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",12336,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fscripts\u002Fprocess.py",[128,154,177,203,229,255],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,41,141,142,46,143,144,145,146,147,148,149,150,151,152,153],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,150,163,164,140,165,41,46,166,31,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[171,188,189,190,191,41,192,193,166,45,194,195,196,197,198,38,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,41,214,215,216,217,218,219,220,221,222,223,224,225,168,226,227,228],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[235],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,41,240,241,43,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,263,41,264,265,266,267,268,269,270,271,38,272,199,273,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]