[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF4CF411QGKW06EZXGAEVZ":3,"skill-same:01M6AF4CF411QGKW06EZXGAEVZ":133},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M6AF4CF411QGKW06EZXGAEVZ","implementing-endpoint-dlp-controls",null,"Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing endpoint dlp controls","dlp","endpoint","data-protection","content-inspection","prevention","t1547","t1059","t1055","data-loss-prevention","security","endpoint-security","data","data protection","exfiltration","email","cloud","pr","storage","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-endpoint-dlp-controls\ndescription: 'Implements endpoint Data Loss Prevention (DLP) controls to detect and\n  prevent sensitive data exfiltration through email, USB, cloud storage, and printing.\n  Use when deploying DLP agents, creating content inspection policies, or preventing\n  unauthorized data movement from endpoints. Activates for requests involving DLP,\n  data exfiltration prevention, content inspection, or sensitive data protection on\n  endpoints.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- DLP\n- data-loss-prevention\n- data-protection\n- content-inspection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\n- MAP-5.1\n- MANAGE-2.4\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1048\n---\n# Implementing Endpoint DLP Controls\n\n## When to Use\n\nUse this skill when:\n- Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization\n- Configuring content inspection rules for email attachments, USB transfers, and cloud uploads\n- Implementing Microsoft Purview DLP or Symantec DLP endpoint policies\n- Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)\n\n**Do not use** for network DLP (inline proxy-based) or cloud-only DLP (CASB).\n\n## Prerequisites\n\n- Microsoft 365 E5 or standalone Microsoft Purview DLP license\n- Microsoft Purview compliance portal access (compliance.microsoft.com)\n- Sensitive Information Types (SITs) defined for organization data\n- Endpoint onboarded to Microsoft Purview (via Intune or SCCM)\n\n## Workflow\n\n### Step 1: Define Sensitive Information Types\n\n```\nMicrosoft Purview → Data Classification → Sensitive info types\n\nBuilt-in SITs for common data:\n- Credit card number (PCI)\n- Social Security Number (PII)\n- Health records (HIPAA)\n- Passport number\n- Bank account number\n\nCustom SIT example (Employee ID):\n  Pattern: EMP-[0-9]{6}\n  Confidence: High\n  Keywords: \"employee id\", \"emp id\", \"staff number\"\n```\n\n### Step 2: Create DLP Policy\n\n```\nMicrosoft Purview → Data loss prevention → Policies → Create policy\n\nPolicy Configuration:\n1. Template: Financial \u002F Medical \u002F PII (or custom)\n2. Locations: Devices (endpoint DLP)\n3. Conditions:\n   - Content contains: Credit card numbers (min 5 instances)\n   - OR Content contains: SSN (min 1 instance)\n4. Actions:\n   - Block: Prevent copy to USB, cloud, email\n   - Audit: Log but allow (for initial deployment)\n   - Notify: Show user notification with policy tip\n5. User notifications:\n   - \"This file contains sensitive data and cannot be copied to this location\"\n   - Allow override with business justification (optional)\n```\n\n### Step 3: Configure Endpoint DLP Activities\n\n```\nMonitored endpoint activities:\n- Upload to cloud service (OneDrive, Dropbox, Google Drive)\n- Copy to removable media (USB drives)\n- Copy to network share\n- Print document\n- Copy to clipboard\n- Access by unallowed browser (non-managed browser)\n- Access by unallowed app\n- Copy to Remote Desktop session\n\nFor each activity, configure:\n- Audit only (log the action)\n- Block with override (user can justify and proceed)\n- Block (prevent action entirely)\n```\n\n### Step 4: Deploy in Audit Mode\n\n```\nDeploy DLP policy in \"Test mode with notifications\" first:\n1. Policy runs in audit mode for 2-4 weeks\n2. Review DLP alerts in Activity Explorer\n3. Identify false positives\n4. Tune SIT patterns and conditions\n5. Add exclusions for legitimate workflows\n6. Switch to \"Turn on the policy\" (enforcement)\n```\n\n### Step 5: Monitor and Respond\n\n```\nPurview → Data loss prevention → Activity explorer\n\nKey metrics:\n- DLP policy matches per day\u002Fweek\n- Top matched sensitive info types\n- Top users triggering DLP\n- Top activities blocked (USB, cloud, email)\n- Override rate (percentage of blocks overridden)\n\nDLP incident response:\n1. Review DLP alert with matched content\n2. Verify sensitivity of detected data\n3. Assess intent (accidental vs. intentional)\n4. If intentional exfiltration → escalate to security incident\n5. If accidental → educate user, refine policy\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DLP** | Data Loss Prevention; technology that detects and prevents unauthorized transmission of sensitive data |\n| **SIT** | Sensitive Information Type; pattern matching rules for identifying sensitive data (regex, keywords, ML classifiers) |\n| **Policy Tip** | User-facing notification explaining why an action was blocked and how to request an override |\n| **Content Inspection** | Deep inspection of file contents to identify sensitive data patterns |\n| **Exact Data Match (EDM)** | DLP matching against a specific database of known sensitive values (exact SSNs, employee records) |\n\n## Tools & Systems\n\n- **Microsoft Purview DLP**: Cloud-managed endpoint DLP included in M365 E5\n- **Symantec DLP (Broadcom)**: Enterprise DLP with endpoint, network, and cloud modules\n- **Digital Guardian**: Endpoint DLP with data classification and protection\n- **Forcepoint DLP**: Unified DLP platform with endpoint agent\n- **Code42 Incydr**: Insider risk detection with file exfiltration monitoring\n\n## Common Pitfalls\n\n- **Over-blocking in enforcement mode**: Deploy DLP in audit mode first. Blocking common workflows without warning causes productivity loss.\n- **Too many SIT false positives**: Phone numbers, dates, and random number sequences can match PCI\u002FSSN patterns. Tune confidence levels and require corroborating keywords.\n- **Ignoring user education**: DLP is most effective when users understand why data is protected. Policy tips should explain the restriction and provide approved alternatives.\n- **Not monitoring overrides**: If users frequently override DLP blocks, the policy is either too restrictive or users are ignoring data protection requirements. Review override reasons.\n","# Implementing Endpoint DLP Controls\n\n## When to Use\n\nUse this skill when:\n- Deploying endpoint DLP to prevent sensitive data (PII, PHI, PCI) from leaving the organization\n- Configuring content inspection rules for email attachments, USB transfers, and cloud uploads\n- Implementing Microsoft Purview DLP or Symantec DLP endpoint policies\n- Meeting compliance requirements for data protection (GDPR, HIPAA, PCI DSS)\n\n**Do not use** for network DLP (inline proxy-based) or cloud-only DLP (CASB).\n\n## Prerequisites\n\n- Microsoft 365 E5 or standalone Microsoft Purview DLP license\n- Microsoft Purview compliance portal access (compliance.microsoft.com)\n- Sensitive Information Types (SITs) defined for organization data\n- Endpoint onboarded to Microsoft Purview (via Intune or SCCM)\n\n## Workflow\n\n### Step 1: Define Sensitive Information Types\n\n```\nMicrosoft Purview → Data Classification → Sensitive info types\n\nBuilt-in SITs for common data:\n- Credit card number (PCI)\n- Social Security Number (PII)\n- Health records (HIPAA)\n- Passport number\n- Bank account number\n\nCustom SIT example (Employee ID):\n  Pattern: EMP-[0-9]{6}\n  Confidence: High\n  Keywords: \"employee id\", \"emp id\", \"staff number\"\n```\n\n### Step 2: Create DLP Policy\n\n```\nMicrosoft Purview → Data loss prevention → Policies → Create policy\n\nPolicy Configuration:\n1. Template: Financial \u002F Medical \u002F PII (or custom)\n2. Locations: Devices (endpoint DLP)\n3. Conditions:\n   - Content contains: Credit card numbers (min 5 instances)\n   - OR Content contains: SSN (min 1 instance)\n4. Actions:\n   - Block: Prevent copy to USB, cloud, email\n   - Audit: Log but allow (for initial deployment)\n   - Notify: Show user notification with policy tip\n5. User notifications:\n   - \"This file contains sensitive data and cannot be copied to this location\"\n   - Allow override with business justification (optional)\n```\n\n### Step 3: Configure Endpoint DLP Activities\n\n```\nMonitored endpoint activities:\n- Upload to cloud service (OneDrive, Dropbox, Google Drive)\n- Copy to removable media (USB drives)\n- Copy to network share\n- Print document\n- Copy to clipboard\n- Access by unallowed browser (non-managed browser)\n- Access by unallowed app\n- Copy to Remote Desktop session\n\nFor each activity, configure:\n- Audit only (log the action)\n- Block with override (user can justify and proceed)\n- Block (prevent action entirely)\n```\n\n### Step 4: Deploy in Audit Mode\n\n```\nDeploy DLP policy in \"Test mode with notifications\" first:\n1. Policy runs in audit mode for 2-4 weeks\n2. Review DLP alerts in Activity Explorer\n3. Identify false positives\n4. Tune SIT patterns and conditions\n5. Add exclusions for legitimate workflows\n6. Switch to \"Turn on the policy\" (enforcement)\n```\n\n### Step 5: Monitor and Respond\n\n```\nPurview → Data loss prevention → Activity explorer\n\nKey metrics:\n- DLP policy matches per day\u002Fweek\n- Top matched sensitive info types\n- Top users triggering DLP\n- Top activities blocked (USB, cloud, email)\n- Override rate (percentage of blocks overridden)\n\nDLP incident response:\n1. Review DLP alert with matched content\n2. Verify sensitivity of detected data\n3. Assess intent (accidental vs. intentional)\n4. If intentional exfiltration → escalate to security incident\n5. If accidental → educate user, refine policy\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DLP** | Data Loss Prevention; technology that detects and prevents unauthorized transmission of sensitive data |\n| **SIT** | Sensitive Information Type; pattern matching rules for identifying sensitive data (regex, keywords, ML classifiers) |\n| **Policy Tip** | User-facing notification explaining why an action was blocked and how to request an override |\n| **Content Inspection** | Deep inspection of file contents to identify sensitive data patterns |\n| **Exact Data Match (EDM)** | DLP matching against a specific database of known sensitive values (exact SSNs, employee records) |\n\n## Tools & Systems\n\n- **Microsoft Purview DLP**: Cloud-managed endpoint DLP included in M365 E5\n- **Symantec DLP (Broadcom)**: Enterprise DLP with endpoint, network, and cloud modules\n- **Digital Guardian**: Endpoint DLP with data classification and protection\n- **Forcepoint DLP**: Unified DLP platform with endpoint agent\n- **Code42 Incydr**: Insider risk detection with file exfiltration monitoring\n\n## Common Pitfalls\n\n- **Over-blocking in enforcement mode**: Deploy DLP in audit mode first. Blocking common workflows without warning causes productivity loss.\n- **Too many SIT false positives**: Phone numbers, dates, and random number sequences can match PCI\u002FSSN patterns. Tune confidence levels and require corroborating keywords.\n- **Ignoring user education**: DLP is most effective when users understand why data is protected. Policy tips should explain the restriction and provide approved alternatives.\n- **Not monitoring overrides**: If users frequently override DLP blocks, the policy is either too restrictive or users are ignoring data protection requirements. Review override reasons.\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":35,"description":58,"nist_ai_rmf":59,"mitre_attack":65,"atlas_techniques":71},[26,50,33,27,28],"DLP","mahipal","1.0.0",[54,55,56,57],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.\n",[60,61,62,63,64],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4",[66,67,68,69,70],"T1055","T1547","T1059","T1036","T1048",[72,73],"AML.T0024","AML.T0056","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-endpoint-dlp-controls",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-endpoint-dlp-controls",{"tool":90,"command":91},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-endpoint-dlp-controls",{"tool":93,"command":94},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-endpoint-dlp-controls","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002FSKILL.md",true,[98,104,109,115,119,123,129],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"assets\u002Ftemplate.md","ASSET","资产文件",427,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Fassets\u002Ftemplate.md",{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",1517,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fstandards.md",391,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Freferences\u002Fstandards.md",{"path":120,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fworkflows.md",306,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Freferences\u002Fworkflows.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",6239,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Fscripts\u002Fagent.py",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fprocess.py",1954,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-endpoint-dlp-controls\u002Fscripts\u002Fprocess.py",[134,159,183,211,236,263],{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,144,145,34,43,146,147,41,148,149,150,151,152,153,154,155,156,157,158],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[165],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,155,168,169,34,170,43,41,171,172,173,174,175,176,177,178,179,180,181,182],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":193,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[189,192],{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,194,195,196,197,43,198,199,171,200,201,202,203,204,205,206,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,43,222,223,224,225,226,227,228,36,229,230,231,232,174,233,234,235],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[244,245,246,43,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[269],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,271,43,272,273,274,275,276,277,278,279,206,280,207,281,282,283,284,285,286],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]