[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF8HFF5GYHB5EWKH3CTM6N":3,"skill-same:01M6AF8HFF5GYHB5EWKH3CTM6N":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AF8HFF5GYHB5EWKH3CTM6N","implementing-mobile-application-management",null,"Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing mobile application management","data","mam","intune","devices","prevention","t1059","t1078","owasp","enterprise-security","personal","Enterprise","owasp-mobile","ios","mobile-security","deployment","pr","cybersecurity","security","android","2026-11-10 10:12:30",false,"---\nname: implementing-mobile-application-management\ndescription: 'Implements Mobile Application Management (MAM) policies to protect enterprise\n  data on managed and unmanaged mobile devices through app-level controls including\n  data loss prevention, selective wipe, app configuration, and containerization. Use\n  when securing corporate apps on BYOD devices, implementing Intune App Protection\n  Policies, or enforcing data separation between personal and work apps. Activates\n  for requests involving MAM deployment, app protection policies, mobile containerization,\n  or BYOD security.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- mam\n- enterprise-security\n- owasp-mobile\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1610\n---\n# Implementing Mobile Application Management\n\n## When to Use\n\nUse this skill when:\n- Deploying enterprise mobile app protection without full device management (MDM)\n- Implementing BYOD policies that protect corporate data while respecting personal privacy\n- Configuring Microsoft Intune App Protection Policies for iOS and Android\n- Enforcing data loss prevention controls on managed mobile applications\n\n**Do not use** when full device management (MDM) is already deployed and sufficient -- MAM adds complexity when MDM already provides the needed controls.\n\n## Prerequisites\n\n- Microsoft Intune or equivalent MAM platform (VMware Workspace ONE, MobileIron)\n- Azure AD for identity and conditional access policies\n- Intune App SDK integrated into target applications (or Intune App Wrapping Tool)\n- Test devices (Android 10+ and iOS 15+)\n- Azure AD Premium P1 or P2 licenses for conditional access\n\n## Workflow\n\n### Step 1: Define App Protection Policy Requirements\n\nClassify data sensitivity and define protection tiers:\n\n| Tier | Data Type | Controls |\n|------|-----------|----------|\n| Tier 1 - Basic | General corporate email | Require PIN, block screenshots |\n| Tier 2 - Enhanced | Financial data, HR records | Encrypt app data, restrict cut\u002Fcopy\u002Fpaste |\n| Tier 3 - High | PII, healthcare, legal | Selective wipe, offline access limits, DLP |\n\n### Step 2: Configure Intune App Protection Policies\n\n**Android App Protection Policy:**\n```json\n{\n    \"displayName\": \"Corporate App Protection - Tier 2\",\n    \"platform\": \"android\",\n    \"dataProtectionSettings\": {\n        \"allowedDataStorageLocations\": [\"oneDriveForBusiness\", \"sharePoint\"],\n        \"blockDataTransferToOtherApps\": \"managedApps\",\n        \"blockDataTransferFromOtherApps\": \"managedApps\",\n        \"saveAsBlocked\": true,\n        \"clipboardSharingLevel\": \"managedAppsWithPasteIn\",\n        \"screenCaptureBlocked\": true,\n        \"encryptAppData\": true,\n        \"backupBlocked\": true\n    },\n    \"accessSettings\": {\n        \"pinRequired\": true,\n        \"minimumPinLength\": 6,\n        \"biometricEnabled\": true,\n        \"offlineGracePeriod\": 720,\n        \"offlineWipeInterval\": 90\n    },\n    \"conditionalLaunchSettings\": {\n        \"maxOsVersion\": \"15.0\",\n        \"minOsVersion\": \"12.0\",\n        \"jailbreakBlocked\": true,\n        \"maxPinRetries\": 5\n    }\n}\n```\n\n### Step 3: Implement App Configuration Policies\n\nDeploy managed app configuration for automatic endpoint setup:\n\n```json\n{\n    \"displayName\": \"Email App Configuration\",\n    \"targetedManagedApps\": [\"com.microsoft.outlooklite\"],\n    \"settings\": [\n        {\"key\": \"com.microsoft.outlook.EmailProfile.AccountType\", \"value\": \"ModernAuth\"},\n        {\"key\": \"com.microsoft.outlook.EmailProfile.ServerName\", \"value\": \"outlook.office365.com\"},\n        {\"key\": \"com.microsoft.outlook.EmailProfile.AllowedDomains\", \"value\": \"corporate.com\"}\n    ]\n}\n```\n\n### Step 4: Deploy Conditional Access Integration\n\n```\nAzure AD > Conditional Access > New Policy:\n- Users: All users with corporate apps\n- Cloud apps: Office 365, custom LOB apps\n- Conditions: All platforms\n- Grant: Require app protection policy\n- Session: App enforced restrictions\n```\n\n### Step 5: Test and Validate MAM Controls\n\nTest each policy control on both platforms:\n\n```bash\n# Verify data transfer restrictions\n1. Open managed app (Outlook)\n2. Copy text from email body\n3. Attempt paste in unmanaged app (Notes) -- should be blocked\n4. Attempt paste in managed app (Teams) -- should work\n\n# Verify selective wipe\n1. Enroll test device with MAM\n2. Access corporate data in managed apps\n3. Trigger selective wipe from Intune portal\n4. Verify corporate data removed, personal data intact\n\n# Verify offline grace period\n1. Access managed app while connected\n2. Disconnect from network\n3. After grace period expires, verify app access blocked\n```\n\n### Step 6: Monitor and Respond\n\nConfigure MAM monitoring dashboards:\n- App protection policy assignment status\n- Non-compliant device\u002Fuser reports\n- Selective wipe execution logs\n- Jailbreak\u002Froot detection alerts\n- Failed PIN attempt tracking\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MAM** | Mobile Application Management - app-level policies without requiring full device enrollment |\n| **App Protection Policy** | Set of rules enforcing data protection at the app level (encryption, DLP, access controls) |\n| **Selective Wipe** | Removing only corporate data from managed apps while preserving personal data |\n| **App Wrapping** | Post-build process applying MAM SDK policies to apps without source code modification |\n| **Containerization** | Isolating corporate app data in an encrypted container separate from personal apps |\n\n## Tools & Systems\n\n- **Microsoft Intune**: Cloud-based MAM\u002FMDM platform with app protection policies\n- **Intune App SDK**: SDK for integrating MAM controls into custom iOS\u002FAndroid apps\n- **Intune App Wrapping Tool**: Post-compilation tool for applying MAM policies without code changes\n- **VMware Workspace ONE**: Alternative MAM platform with app containerization\n- **Azure AD Conditional Access**: Policy engine for enforcing MAM enrollment as access condition\n\n## Common Pitfalls\n\n- **SDK version mismatch**: Intune App SDK version must match the policy version. Outdated SDK versions may silently fail to enforce newer policies.\n- **iOS managed pasteboard**: iOS enforces paste restrictions through managed pasteboard, which requires the app to opt-in via Intune SDK integration.\n- **App wrapping limitations**: Wrapped apps cannot use certain features (push notifications on some platforms). SDK integration is preferred for full functionality.\n- **User experience friction**: Overly restrictive policies cause user frustration and shadow IT. Start with Tier 1 and escalate based on data sensitivity.\n","# Implementing Mobile Application Management\n\n## When to Use\n\nUse this skill when:\n- Deploying enterprise mobile app protection without full device management (MDM)\n- Implementing BYOD policies that protect corporate data while respecting personal privacy\n- Configuring Microsoft Intune App Protection Policies for iOS and Android\n- Enforcing data loss prevention controls on managed mobile applications\n\n**Do not use** when full device management (MDM) is already deployed and sufficient -- MAM adds complexity when MDM already provides the needed controls.\n\n## Prerequisites\n\n- Microsoft Intune or equivalent MAM platform (VMware Workspace ONE, MobileIron)\n- Azure AD for identity and conditional access policies\n- Intune App SDK integrated into target applications (or Intune App Wrapping Tool)\n- Test devices (Android 10+ and iOS 15+)\n- Azure AD Premium P1 or P2 licenses for conditional access\n\n## Workflow\n\n### Step 1: Define App Protection Policy Requirements\n\nClassify data sensitivity and define protection tiers:\n\n| Tier | Data Type | Controls |\n|------|-----------|----------|\n| Tier 1 - Basic | General corporate email | Require PIN, block screenshots |\n| Tier 2 - Enhanced | Financial data, HR records | Encrypt app data, restrict cut\u002Fcopy\u002Fpaste |\n| Tier 3 - High | PII, healthcare, legal | Selective wipe, offline access limits, DLP |\n\n### Step 2: Configure Intune App Protection Policies\n\n**Android App Protection Policy:**\n```json\n{\n    \"displayName\": \"Corporate App Protection - Tier 2\",\n    \"platform\": \"android\",\n    \"dataProtectionSettings\": {\n        \"allowedDataStorageLocations\": [\"oneDriveForBusiness\", \"sharePoint\"],\n        \"blockDataTransferToOtherApps\": \"managedApps\",\n        \"blockDataTransferFromOtherApps\": \"managedApps\",\n        \"saveAsBlocked\": true,\n        \"clipboardSharingLevel\": \"managedAppsWithPasteIn\",\n        \"screenCaptureBlocked\": true,\n        \"encryptAppData\": true,\n        \"backupBlocked\": true\n    },\n    \"accessSettings\": {\n        \"pinRequired\": true,\n        \"minimumPinLength\": 6,\n        \"biometricEnabled\": true,\n        \"offlineGracePeriod\": 720,\n        \"offlineWipeInterval\": 90\n    },\n    \"conditionalLaunchSettings\": {\n        \"maxOsVersion\": \"15.0\",\n        \"minOsVersion\": \"12.0\",\n        \"jailbreakBlocked\": true,\n        \"maxPinRetries\": 5\n    }\n}\n```\n\n### Step 3: Implement App Configuration Policies\n\nDeploy managed app configuration for automatic endpoint setup:\n\n```json\n{\n    \"displayName\": \"Email App Configuration\",\n    \"targetedManagedApps\": [\"com.microsoft.outlooklite\"],\n    \"settings\": [\n        {\"key\": \"com.microsoft.outlook.EmailProfile.AccountType\", \"value\": \"ModernAuth\"},\n        {\"key\": \"com.microsoft.outlook.EmailProfile.ServerName\", \"value\": \"outlook.office365.com\"},\n        {\"key\": \"com.microsoft.outlook.EmailProfile.AllowedDomains\", \"value\": \"corporate.com\"}\n    ]\n}\n```\n\n### Step 4: Deploy Conditional Access Integration\n\n```\nAzure AD > Conditional Access > New Policy:\n- Users: All users with corporate apps\n- Cloud apps: Office 365, custom LOB apps\n- Conditions: All platforms\n- Grant: Require app protection policy\n- Session: App enforced restrictions\n```\n\n### Step 5: Test and Validate MAM Controls\n\nTest each policy control on both platforms:\n\n```bash\n# Verify data transfer restrictions\n1. Open managed app (Outlook)\n2. Copy text from email body\n3. Attempt paste in unmanaged app (Notes) -- should be blocked\n4. Attempt paste in managed app (Teams) -- should work\n\n# Verify selective wipe\n1. Enroll test device with MAM\n2. Access corporate data in managed apps\n3. Trigger selective wipe from Intune portal\n4. Verify corporate data removed, personal data intact\n\n# Verify offline grace period\n1. Access managed app while connected\n2. Disconnect from network\n3. After grace period expires, verify app access blocked\n```\n\n### Step 6: Monitor and Respond\n\nConfigure MAM monitoring dashboards:\n- App protection policy assignment status\n- Non-compliant device\u002Fuser reports\n- Selective wipe execution logs\n- Jailbreak\u002Froot detection alerts\n- Failed PIN attempt tracking\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MAM** | Mobile Application Management - app-level policies without requiring full device enrollment |\n| **App Protection Policy** | Set of rules enforcing data protection at the app level (encryption, DLP, access controls) |\n| **Selective Wipe** | Removing only corporate data from managed apps while preserving personal data |\n| **App Wrapping** | Post-build process applying MAM SDK policies to apps without source code modification |\n| **Containerization** | Isolating corporate app data in an encrypted container separate from personal apps |\n\n## Tools & Systems\n\n- **Microsoft Intune**: Cloud-based MAM\u002FMDM platform with app protection policies\n- **Intune App SDK**: SDK for integrating MAM controls into custom iOS\u002FAndroid apps\n- **Intune App Wrapping Tool**: Post-compilation tool for applying MAM policies without code changes\n- **VMware Workspace ONE**: Alternative MAM platform with app containerization\n- **Azure AD Conditional Access**: Policy engine for enforcing MAM enrollment as access condition\n\n## Common Pitfalls\n\n- **SDK version mismatch**: Intune App SDK version must match the policy version. Outdated SDK versions may silently fail to enforce newer policies.\n- **iOS managed pasteboard**: iOS enforces paste restrictions through managed pasteboard, which requires the app to opt-in via Intune SDK integration.\n- **App wrapping limitations**: Wrapped apps cannot use certain features (push notifications on some platforms). SDK integration is preferred for full functionality.\n- **User experience friction**: Overly restrictive policies cause user frustration and shadow IT. Start with Tier 1 and escalate based on data sensitivity.\n",{"name":5,"tags":49,"author":50,"domain":41,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":57,"mitre_attack":58},[38,43,37,26,33,36],"mahipal","1.0.0",[53,54,55,56],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.\n",[59,60,61,62,63],"T1059","T1056","T1036","T1078","T1610","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-mobile-application-management",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-mobile-application-management",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-mobile-application-management",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-mobile-application-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",628,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1310,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",758,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",808,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",5955,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",3793,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-mobile-application-management\u002Fscripts\u002Fprocess.py",[124,149,173,200,225,252],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,42,41,136,137,40,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,42,160,41,40,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,41,188,189,161,190,191,192,193,194,195,31,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,41,211,212,213,214,215,216,217,25,218,219,220,221,164,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,41,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,260,41,261,262,263,264,265,266,267,268,31,269,196,270,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]