[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF6PNXZ3SBM00Z07E9FKMB":3,"skill-same:01M6AF6PNXZ3SBM00Z07E9FKMB":159},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":96,"commitSha":97,"skillDirectory":98,"forksCount":99,"repositoryHtmlUrl":100,"repositoryHomepageUrl":101,"ownerHtmlUrl":102,"ownerBlogUrl":103,"ownerDescription":104,"updatedAt":105,"install":106,"resources":119},"01M6AF6PNXZ3SBM00Z07E9FKMB","implementing-identity-verification-for-zero-trust",null,"Implements continuous, risk-adaptive identity verification for zero trust using phishing-resistant MFA (FIDO2\u002FWebAuthn), risk-based conditional access, and identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity Model Identity Pillar. Use when designing zero trust identity controls, deploying phishing-resistant MFA, or building conditional access policies based on device posture, behavior, and location.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing identity verification for zero trust","identity","verification","ZeRO","zero-trust","WebAuthn","FIDO2","t1566","initial-access","risk","t1059","t1078","identity-verification","cybersecurity","NIST","CISA","phishing","authentication","pr","architecture","2026-11-10 10:12:30",false,"---\nname: implementing-identity-verification-for-zero-trust\ndescription: Implements continuous, risk-adaptive identity verification for zero trust\n  using phishing-resistant MFA (FIDO2\u002FWebAuthn), risk-based conditional access, and\n  identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity\n  Model Identity Pillar. Use when designing zero trust identity controls, deploying\n  phishing-resistant MFA, or building conditional access policies based on device\n  posture, behavior, and location.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- identity\n- authentication\n- mfa\n- identity-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0052\nnist_ai_rmf:\n- GOVERN-1.1\n- GOVERN-1.7\n- MAP-1.1\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1566\n- T1598\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - reconnaissance\n  techniques:\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: T1110.004\n    name: 'Brute Force:  Credential Stuffing'\n    tactic: initial-access\n    source: attack\n  - id: T1111\n    name: Multi-Factor Authentication Interception\n    tactic: initial-access\n    source: attack\n  - id: T1557\n    name: Adversary-in-the-Middle\n    tactic: initial-access\n    source: attack\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n---\n\n# Implementing Identity Verification for Zero Trust\n\n## Prerequisites\n\n- Understanding of zero trust principles (NIST SP 800-207)\n- Familiarity with identity providers (Azure AD, Okta, Ping Identity)\n- Knowledge of authentication protocols (SAML 2.0, OIDC, FIDO2)\n- Understanding of MFA and passwordless authentication\n\n## Overview\n\nIdentity is the foundational pillar of zero trust architecture. NIST SP 800-207 mandates that all resource authentication and authorization are dynamic and strictly enforced before access is allowed. Identity verification in zero trust goes beyond traditional username\u002Fpassword by implementing continuous, risk-adaptive authentication using multiple signals including device posture, behavioral biometrics, location, and network context.\n\nThis skill covers implementing phishing-resistant MFA, continuous identity verification, risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model Identity Pillar.\n\n\n## When to Use\n\n- When deploying or configuring implementing identity verification for zero trust capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with zero trust architecture concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Identity Verification Flow\n\n```\nUser Access Request\n    │\n    v\n┌───────────────────────┐\n│ Primary Authentication │\n│ - FIDO2\u002FWebAuthn key  │\n│ - Certificate-based    │\n│ - Passwordless         │\n└──────────┬────────────┘\n           v\n┌───────────────────────┐\n│ Contextual Assessment  │\n│ - Device posture       │\n│ - Network location     │\n│ - Geo-velocity check   │\n│ - Time of access       │\n│ - Behavioral baseline  │\n└──────────┬────────────┘\n           v\n┌───────────────────────┐\n│ Risk Scoring Engine    │\n│ - Aggregate signals    │\n│ - Calculate risk score │\n│ - Compare to threshold │\n└───┬──────────┬────────┘\n    │          │\n Low Risk   High Risk\n    │          │\n    v          v\n┌────────┐  ┌──────────────┐\n│ Grant  │  │ Step-up Auth  │\n│ Access │  │ - Hardware key│\n│        │  │ - Biometric   │\n│        │  │ - Manager OK  │\n└────────┘  └──────────────┘\n```\n\n### Identity Provider Architecture\n\n1. **Primary IdP**: Azure AD \u002F Okta \u002F Ping Identity for centralized identity management\n2. **FIDO2 Authenticators**: Hardware security keys (YubiKey) or platform authenticators (Windows Hello, Touch ID)\n3. **Risk Engine**: Adaptive access using identity threat detection (Microsoft Entra ID Protection, Okta ThreatInsight)\n4. **Identity Governance**: Lifecycle management, access reviews, just-in-time provisioning\n5. **Privileged Identity**: Separate verification for elevated access (CyberArk, BeyondTrust)\n\n## Key Concepts\n\n### Phishing-Resistant MFA\nFIDO2\u002FWebAuthn eliminates phishable credentials by binding authentication to the origin domain. Hardware security keys and platform authenticators provide cryptographic proof of identity without transmitting secrets.\n\n### Continuous Identity Verification\nRather than authenticating once at session start, zero trust requires ongoing verification through session token evaluation, behavioral analytics, and periodic re-authentication challenges based on risk signals.\n\n### Risk-Based Conditional Access\nConditional access policies evaluate multiple signals (user risk level, sign-in risk, device compliance, location) to dynamically adjust authentication requirements and access grants.\n\n### Identity Threat Detection\nAI-driven analytics detect compromised identities through impossible travel detection, anomalous sign-in patterns, credential stuffing detection, and token replay attacks.\n\n## Workflow\n\n### Phase 1: Identity Infrastructure\n\n1. **Consolidate Identity Providers**\n   - Audit all identity sources across the organization\n   - Federate to a single authoritative IdP using SAML 2.0 or OIDC\n   - Configure SCIM for automated provisioning and deprovisioning\n   - Eliminate local accounts and shared credentials\n\n2. **Deploy Phishing-Resistant MFA**\n   - Enroll all users in FIDO2\u002FWebAuthn with hardware security keys\n   - Configure platform authenticators (Windows Hello for Business, macOS Touch ID)\n   - Disable SMS and voice call as MFA methods (phishable)\n   - Create conditional access policy requiring phishing-resistant methods for all sign-ins\n\n3. **Configure Conditional Access Policies**\n   - Require compliant device for access to sensitive applications\n   - Block legacy authentication protocols (basic auth, IMAP, POP3)\n   - Require MFA for all users from untrusted locations\n   - Enforce session time limits with re-authentication\n   - Block or require additional verification for high-risk sign-ins\n\n### Phase 2: Risk-Based Authentication\n\n4. **Enable Identity Threat Detection**\n   - Activate Microsoft Entra ID Protection or Okta ThreatInsight\n   - Configure risk levels: low (allow), medium (require MFA), high (block and investigate)\n   - Enable impossible travel detection and anomalous token alerts\n   - Integrate identity risk signals with SIEM\u002FSOAR\n\n5. **Implement Step-Up Authentication**\n   - For sensitive operations (privilege elevation, financial transactions), require additional verification\n   - Configure step-up policies: re-authenticate with hardware key\n   - Integrate with PAM for privileged session approval workflows\n   - Log all step-up events for audit trail\n\n### Phase 3: Continuous Verification\n\n6. **Deploy Continuous Access Evaluation (CAE)**\n   - Enable Continuous Access Evaluation Protocol (CAEP) for real-time token revocation\n   - Configure critical event triggers: user disabled, password changed, location change\n   - Test that token revocation occurs within minutes (not hours) of security event\n   - Monitor CAE event logs for operational health\n\n7. **Implement Session Controls**\n   - Configure session duration limits based on application sensitivity\n   - Enable sign-in frequency controls (re-authenticate every N hours)\n   - Implement persistent browser session controls\n   - Configure app-enforced restrictions for unmanaged devices\n\n### Phase 4: Identity Governance\n\n8. **Automate Identity Lifecycle**\n   - Configure joiner-mover-leaver workflows with HR system integration\n   - Automate access provisioning based on role and department\n   - Enable just-in-time access for temporary elevated permissions\n   - Configure automatic access expiration for contractors and guests\n\n9. **Implement Access Reviews**\n   - Schedule quarterly access certification campaigns\n   - Configure automated reminders and escalation\n   - Require manager approval for continued access\n   - Auto-revoke access for unreviewed certifications\n\n## Validation Checklist\n\n- [ ] Single authoritative IdP with all applications federated\n- [ ] FIDO2\u002FWebAuthn enrolled for all users\n- [ ] SMS and voice MFA methods disabled\n- [ ] Legacy authentication protocols blocked\n- [ ] Conditional access policies enforced for all applications\n- [ ] Identity threat detection active with risk-based policies\n- [ ] Continuous Access Evaluation enabled and tested\n- [ ] Step-up authentication configured for sensitive operations\n- [ ] Identity lifecycle automated with HR integration\n- [ ] Quarterly access reviews scheduled and operational\n- [ ] Identity events streaming to SIEM\n\n## References\n\n- NIST SP 800-207: Zero Trust Architecture\n- NIST SP 800-63B: Digital Identity Guidelines - Authentication\n- CISA Zero Trust Maturity Model v2.0 - Identity Pillar\n- FIDO Alliance WebAuthn Specification\n- Microsoft Entra Conditional Access Documentation\n","# Implementing Identity Verification for Zero Trust\n\n## Prerequisites\n\n- Understanding of zero trust principles (NIST SP 800-207)\n- Familiarity with identity providers (Azure AD, Okta, Ping Identity)\n- Knowledge of authentication protocols (SAML 2.0, OIDC, FIDO2)\n- Understanding of MFA and passwordless authentication\n\n## Overview\n\nIdentity is the foundational pillar of zero trust architecture. NIST SP 800-207 mandates that all resource authentication and authorization are dynamic and strictly enforced before access is allowed. Identity verification in zero trust goes beyond traditional username\u002Fpassword by implementing continuous, risk-adaptive authentication using multiple signals including device posture, behavioral biometrics, location, and network context.\n\nThis skill covers implementing phishing-resistant MFA, continuous identity verification, risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model Identity Pillar.\n\n\n## When to Use\n\n- When deploying or configuring implementing identity verification for zero trust capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with zero trust architecture concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Identity Verification Flow\n\n```\nUser Access Request\n    │\n    v\n┌───────────────────────┐\n│ Primary Authentication │\n│ - FIDO2\u002FWebAuthn key  │\n│ - Certificate-based    │\n│ - Passwordless         │\n└──────────┬────────────┘\n           v\n┌───────────────────────┐\n│ Contextual Assessment  │\n│ - Device posture       │\n│ - Network location     │\n│ - Geo-velocity check   │\n│ - Time of access       │\n│ - Behavioral baseline  │\n└──────────┬────────────┘\n           v\n┌───────────────────────┐\n│ Risk Scoring Engine    │\n│ - Aggregate signals    │\n│ - Calculate risk score │\n│ - Compare to threshold │\n└───┬──────────┬────────┘\n    │          │\n Low Risk   High Risk\n    │          │\n    v          v\n┌────────┐  ┌──────────────┐\n│ Grant  │  │ Step-up Auth  │\n│ Access │  │ - Hardware key│\n│        │  │ - Biometric   │\n│        │  │ - Manager OK  │\n└────────┘  └──────────────┘\n```\n\n### Identity Provider Architecture\n\n1. **Primary IdP**: Azure AD \u002F Okta \u002F Ping Identity for centralized identity management\n2. **FIDO2 Authenticators**: Hardware security keys (YubiKey) or platform authenticators (Windows Hello, Touch ID)\n3. **Risk Engine**: Adaptive access using identity threat detection (Microsoft Entra ID Protection, Okta ThreatInsight)\n4. **Identity Governance**: Lifecycle management, access reviews, just-in-time provisioning\n5. **Privileged Identity**: Separate verification for elevated access (CyberArk, BeyondTrust)\n\n## Key Concepts\n\n### Phishing-Resistant MFA\nFIDO2\u002FWebAuthn eliminates phishable credentials by binding authentication to the origin domain. Hardware security keys and platform authenticators provide cryptographic proof of identity without transmitting secrets.\n\n### Continuous Identity Verification\nRather than authenticating once at session start, zero trust requires ongoing verification through session token evaluation, behavioral analytics, and periodic re-authentication challenges based on risk signals.\n\n### Risk-Based Conditional Access\nConditional access policies evaluate multiple signals (user risk level, sign-in risk, device compliance, location) to dynamically adjust authentication requirements and access grants.\n\n### Identity Threat Detection\nAI-driven analytics detect compromised identities through impossible travel detection, anomalous sign-in patterns, credential stuffing detection, and token replay attacks.\n\n## Workflow\n\n### Phase 1: Identity Infrastructure\n\n1. **Consolidate Identity Providers**\n   - Audit all identity sources across the organization\n   - Federate to a single authoritative IdP using SAML 2.0 or OIDC\n   - Configure SCIM for automated provisioning and deprovisioning\n   - Eliminate local accounts and shared credentials\n\n2. **Deploy Phishing-Resistant MFA**\n   - Enroll all users in FIDO2\u002FWebAuthn with hardware security keys\n   - Configure platform authenticators (Windows Hello for Business, macOS Touch ID)\n   - Disable SMS and voice call as MFA methods (phishable)\n   - Create conditional access policy requiring phishing-resistant methods for all sign-ins\n\n3. **Configure Conditional Access Policies**\n   - Require compliant device for access to sensitive applications\n   - Block legacy authentication protocols (basic auth, IMAP, POP3)\n   - Require MFA for all users from untrusted locations\n   - Enforce session time limits with re-authentication\n   - Block or require additional verification for high-risk sign-ins\n\n### Phase 2: Risk-Based Authentication\n\n4. **Enable Identity Threat Detection**\n   - Activate Microsoft Entra ID Protection or Okta ThreatInsight\n   - Configure risk levels: low (allow), medium (require MFA), high (block and investigate)\n   - Enable impossible travel detection and anomalous token alerts\n   - Integrate identity risk signals with SIEM\u002FSOAR\n\n5. **Implement Step-Up Authentication**\n   - For sensitive operations (privilege elevation, financial transactions), require additional verification\n   - Configure step-up policies: re-authenticate with hardware key\n   - Integrate with PAM for privileged session approval workflows\n   - Log all step-up events for audit trail\n\n### Phase 3: Continuous Verification\n\n6. **Deploy Continuous Access Evaluation (CAE)**\n   - Enable Continuous Access Evaluation Protocol (CAEP) for real-time token revocation\n   - Configure critical event triggers: user disabled, password changed, location change\n   - Test that token revocation occurs within minutes (not hours) of security event\n   - Monitor CAE event logs for operational health\n\n7. **Implement Session Controls**\n   - Configure session duration limits based on application sensitivity\n   - Enable sign-in frequency controls (re-authenticate every N hours)\n   - Implement persistent browser session controls\n   - Configure app-enforced restrictions for unmanaged devices\n\n### Phase 4: Identity Governance\n\n8. **Automate Identity Lifecycle**\n   - Configure joiner-mover-leaver workflows with HR system integration\n   - Automate access provisioning based on role and department\n   - Enable just-in-time access for temporary elevated permissions\n   - Configure automatic access expiration for contractors and guests\n\n9. **Implement Access Reviews**\n   - Schedule quarterly access certification campaigns\n   - Configure automated reminders and escalation\n   - Require manager approval for continued access\n   - Auto-revoke access for unreviewed certifications\n\n## Validation Checklist\n\n- [ ] Single authoritative IdP with all applications federated\n- [ ] FIDO2\u002FWebAuthn enrolled for all users\n- [ ] SMS and voice MFA methods disabled\n- [ ] Legacy authentication protocols blocked\n- [ ] Conditional access policies enforced for all applications\n- [ ] Identity threat detection active with risk-based policies\n- [ ] Continuous Access Evaluation enabled and tested\n- [ ] Step-up authentication configured for sensitive operations\n- [ ] Identity lifecycle automated with HR integration\n- [ ] Quarterly access reviews scheduled and operational\n- [ ] Identity events streaming to SIEM\n\n## References\n\n- NIST SP 800-207: Zero Trust Architecture\n- NIST SP 800-63B: Digital Identity Guidelines - Authentication\n- CISA Zero Trust Maturity Model v2.0 - Identity Pillar\n- FIDO Alliance WebAuthn Specification\n- Microsoft Entra Conditional Access Documentation\n",{"name":5,"tags":49,"author":51,"domain":37,"license":15,"version":52,"mitre_f3":53,"nist_csf":79,"subdomain":84,"description":7,"nist_ai_rmf":85,"mitre_attack":89,"atlas_techniques":94},[28,25,41,50,36],"mfa","mahipal","1.0",{"tactics":54,"version":57,"techniques":58},[32,55,56],"positioning","reconnaissance","1.1",[59,63,67,70,73,76],{"id":60,"name":61,"source":62,"tactic":32},"F1006","Account Takeover","f3",{"id":64,"name":65,"source":66,"tactic":32},"T1110.004","Brute Force:  Credential Stuffing","attack",{"id":68,"name":69,"source":66,"tactic":32},"T1111","Multi-Factor Authentication Interception",{"id":71,"name":72,"source":66,"tactic":32},"T1557","Adversary-in-the-Middle",{"id":74,"name":75,"source":66,"tactic":55},"T1539","Steal Web Session Cookie",{"id":77,"name":78,"source":66,"tactic":56},"T1598","Phishing for Information",[80,81,82,83],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[86,87,88],"GOVERN-1.1","GOVERN-1.7","MAP-1.1",[90,91,92,93,77],"T1078","T1190","T1059","T1566",[95],"AML.T0052","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-identity-verification-for-zero-trust",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":107,"prompt":117,"zipAvailable":118},[108,111,114],{"tool":109,"command":110},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-identity-verification-for-zero-trust",{"tool":112,"command":113},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-identity-verification-for-zero-trust",{"tool":115,"command":116},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-identity-verification-for-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002FSKILL.md",true,[120,126,131,137,141,145,149,155],{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"assets\u002Ftemplate.md","ASSET","资产文件",3144,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Fassets\u002Ftemplate.md",{"path":127,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002FLICENSE",{"path":132,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fadvanced-cloud-scripts.md","REFERENCE","参考文档",11972,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fcloud-penetration-testing\u002Freferences\u002Fadvanced-cloud-scripts.md",{"path":138,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":139,"sourceHtmlUrl":140},"references\u002Fapi-reference.md",1817,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":142,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":143,"sourceHtmlUrl":144},"references\u002Fstandards.md",3933,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Freferences\u002Fstandards.md",{"path":146,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":147,"sourceHtmlUrl":148},"references\u002Fworkflows.md",7005,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Freferences\u002Fworkflows.md",{"path":150,"resourceType":151,"resourceTypeDesc":152,"sizeBytes":153,"sourceHtmlUrl":154},"scripts\u002Fagent.py","SCRIPT","脚本",8824,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Fscripts\u002Fagent.py",{"path":156,"resourceType":151,"resourceTypeDesc":152,"sizeBytes":157,"sourceHtmlUrl":158},"scripts\u002Fprocess.py",14618,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-identity-verification-for-zero-trust\u002Fscripts\u002Fprocess.py",[160,185,207,234,260,285],{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[168,169,170,171,172,37,173,25,42,174,175,176,177,178,179,180,181,182,183,184],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,181,194,195,172,196,37,42,26,27,197,198,199,200,201,202,203,204,205,206],"boot","TPM","validating tpm measured boot attestation","policy","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":217,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[213,216],{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,218,219,220,221,37,222,223,26,224,225,226,227,228,229,35,230,231,232,233],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[240],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[242,243,244,37,245,246,247,248,249,250,251,252,253,254,255,256,198,257,258,259],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[266],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[268,269,270,37,271,272,39,273,274,275,276,277,278,279,33,280,281,282,283,284],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":286,"name":287,"nameZh":6,"description":288,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":289,"categories":290,"keywords":292,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[291],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,293,37,294,295,296,297,298,38,299,300,35,301,230,302,303,304,305,306,307],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]