[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFCDRKW4A1W46H8SBQT8KF":3,"skill-same:01M6AFCDRKW4A1W46H8SBQT8KF":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6AFCDRKW4A1W46H8SBQT8KF","implementing-scim-provisioning-with-okta",null,"Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account creation, attribute sync, or deactivation across downstream applications through Okta SCIM integration, or when troubleshooting SCIM provisioning failures.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing scim provisioning with okta","provisioning","okta","t1078","identity-management","scim","lifecycle","applications","t1098","initial-access","cybersecurity","lifecycle-management","sso","development","pr","identity","sync","change","automation","implement","2026-11-10 10:12:30",false,"---\nname: implementing-scim-provisioning-with-okta\ndescription: Implement automated user lifecycle provisioning and deprovisioning using\n  the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account\n  creation, attribute sync, or deactivation across downstream applications through\n  Okta SCIM integration, or when troubleshooting SCIM provisioning failures.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- scim\n- okta\n- provisioning\n- identity-management\n- automation\n- sso\n- lifecycle-management\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - resource-development\n  techniques:\n  - id: T1586\n    name: Compromise Accounts\n    tactic: resource-development\n    source: attack\n  - id: F1005.002\n    name: 'Account Manipulation: Add Authorized User'\n    tactic: positioning\n    source: f3\n  - id: F1005.004\n    name: 'Account Manipulation: Change Account Details'\n    tactic: positioning\n    source: f3\n  - id: F1042\n    name: Reactivate Account\n    tactic: positioning\n    source: f3\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n---\n\n# Implementing SCIM Provisioning with Okta\n\n## Overview\n\nSCIM (System for Cross-domain Identity Management) is an open standard protocol (RFC 7644) that automates the exchange of user identity information between identity providers like Okta and service providers. This skill covers building a SCIM 2.0-compliant API endpoint and integrating it with Okta for automated user lifecycle management including provisioning, deprovisioning, profile updates, and group management.\n\n\n## When to Use\n\n- When deploying or configuring implementing scim provisioning with okta capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Okta tenant with admin access (Developer or Production)\n- Application with REST API capable of user management\n- TLS-secured endpoint (HTTPS required)\n- Okta API token or OAuth 2.0 client credentials\n- Python 3.9+ with Flask or FastAPI\n\n## Core Concepts\n\n### SCIM 2.0 Protocol\n\nSCIM defines a standard schema for representing users and groups via JSON, with a RESTful API for CRUD operations:\n\n| Operation | HTTP Method | Endpoint | Description |\n|-----------|-------------|----------|-------------|\n| Create User | POST | \u002Fscim\u002Fv2\u002FUsers | Provisions a new user account |\n| Read User | GET | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Retrieves user details |\n| Update User | PUT\u002FPATCH | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Modifies user attributes |\n| Delete User | DELETE | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Removes user account |\n| List Users | GET | \u002Fscim\u002Fv2\u002FUsers | Lists users with filtering |\n| Create Group | POST | \u002Fscim\u002Fv2\u002FGroups | Creates a group |\n| Manage Group | PATCH | \u002Fscim\u002Fv2\u002FGroups\u002F{id} | Add\u002Fremove group members |\n\n### Okta SCIM Integration Architecture\n\n```\nOkta (IdP) ──SCIM 2.0 over HTTPS──> SCIM Server ──> Application Database\n     │                                     │\n     ├── User Assignment                   ├── Create\u002FUpdate User\n     ├── User Unassignment                 ├── Deactivate User\n     ├── Profile Push                      ├── Sync Attributes\n     └── Group Push                        └── Manage Groups\n```\n\n### Required SCIM Endpoints\n\n1. **ServiceProviderConfig** (`\u002Fscim\u002Fv2\u002FServiceProviderConfig`): Advertises SCIM capabilities\n2. **ResourceTypes** (`\u002Fscim\u002Fv2\u002FResourceTypes`): Describes supported resource types\n3. **Schemas** (`\u002Fscim\u002Fv2\u002FSchemas`): Publishes the SCIM schema definitions\n4. **Users** (`\u002Fscim\u002Fv2\u002FUsers`): User lifecycle operations\n5. **Groups** (`\u002Fscim\u002Fv2\u002FGroups`): Group management operations\n\n## Workflow\n\n### Step 1: Build SCIM 2.0 API Server\n\nCreate a Flask-based SCIM server that implements the core endpoints. The server must handle:\n\n- **User CRUD**: Create, read, update, delete, and list users\n- **Filtering**: Support `eq` filter on `userName` (required by Okta)\n- **Pagination**: Return `startIndex`, `itemsPerPage`, and `totalResults`\n- **Authentication**: Bearer token validation on all endpoints\n\n```python\nfrom flask import Flask, request, jsonify\nimport uuid\nfrom datetime import datetime\n\napp = Flask(__name__)\n\n# Bearer token for Okta authentication\nSCIM_BEARER_TOKEN = \"your-secure-token-here\"\n\ndef require_auth(f):\n    def wrapper(*args, **kwargs):\n        auth = request.headers.get(\"Authorization\", \"\")\n        if not auth.startswith(\"Bearer \") or auth[7:] != SCIM_BEARER_TOKEN:\n            return jsonify({\"detail\": \"Unauthorized\"}), 401\n        return f(*args, **kwargs)\n    wrapper.__name__ = f.__name__\n    return wrapper\n\n@app.route(\"\u002Fscim\u002Fv2\u002FUsers\", methods=[\"POST\"])\n@require_auth\ndef create_user():\n    data = request.json\n    user_id = str(uuid.uuid4())\n    user = {\n        \"schemas\": [\"urn:ietf:params:scim:schemas:core:2.0:User\"],\n        \"id\": user_id,\n        \"userName\": data.get(\"userName\"),\n        \"name\": data.get(\"name\", {}),\n        \"emails\": data.get(\"emails\", []),\n        \"active\": True,\n        \"meta\": {\n            \"resourceType\": \"User\",\n            \"created\": datetime.utcnow().isoformat() + \"Z\",\n            \"lastModified\": datetime.utcnow().isoformat() + \"Z\",\n            \"location\": f\"\u002Fscim\u002Fv2\u002FUsers\u002F{user_id}\"\n        }\n    }\n    # Persist user to database\n    return jsonify(user), 201\n\n@app.route(\"\u002Fscim\u002Fv2\u002FUsers\", methods=[\"GET\"])\n@require_auth\ndef list_users():\n    filter_param = request.args.get(\"filter\", \"\")\n    start_index = int(request.args.get(\"startIndex\", 1))\n    count = int(request.args.get(\"count\", 100))\n    # Parse filter: userName eq \"john@example.com\"\n    # Query database with filter\n    return jsonify({\n        \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:ListResponse\"],\n        \"totalResults\": 0,\n        \"startIndex\": start_index,\n        \"itemsPerPage\": count,\n        \"Resources\": []\n    })\n```\n\n### Step 2: Configure Okta Application\n\n1. **Create SCIM App Integration**:\n   - Navigate to Okta Admin Console > Applications > Create App Integration\n   - Select SWA or SAML 2.0 as sign-on method\n   - In the General tab, select SCIM for Provisioning\n\n2. **Configure SCIM Connection**:\n   - SCIM connector base URL: `https:\u002F\u002Fyour-app.com\u002Fscim\u002Fv2`\n   - Unique identifier field: `userName`\n   - Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups\n   - Authentication Mode: HTTP Header (Bearer Token)\n\n3. **Enable Provisioning Features**:\n   - To App: Create Users, Update User Attributes, Deactivate Users\n   - Configure attribute mappings between Okta profile and SCIM schema\n\n### Step 3: Map Attributes\n\nMap Okta user profile attributes to your SCIM schema:\n\n| Okta Attribute | SCIM Attribute | Direction |\n|---------------|----------------|-----------|\n| login | userName | Okta -> App |\n| firstName | name.givenName | Okta -> App |\n| lastName | name.familyName | Okta -> App |\n| email | emails[type eq \"work\"].value | Okta -> App |\n| department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department | Okta -> App |\n\n### Step 4: Implement Error Handling\n\nSCIM specifies standard error response format:\n\n```json\n{\n  \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:Error\"],\n  \"detail\": \"User already exists\",\n  \"status\": \"409\",\n  \"scimType\": \"uniqueness\"\n}\n```\n\nCommon error codes: 400 (Bad Request), 401 (Unauthorized), 404 (Not Found), 409 (Conflict), 500 (Internal Server Error).\n\n### Step 5: Test with Runscope\u002FOkta SCIM Validator\n\nOkta provides an automated SCIM test suite (via Runscope\u002FBlazeMeter) that validates your SCIM implementation against all required operations:\n\n1. Import the Okta SCIM 2.0 test suite from the OIN submission portal\n2. Configure the base URL and authentication token\n3. Run the full test suite covering user CRUD, filtering, and pagination\n4. Fix any failing tests before submitting to OIN\n\n## Validation Checklist\n\n- [ ] SCIM server accessible over HTTPS with valid TLS certificate\n- [ ] Bearer token authentication enforced on all endpoints\n- [ ] User creation returns 201 with full user representation\n- [ ] User search by `userName eq \"...\"` filter works correctly\n- [ ] Pagination parameters (`startIndex`, `count`) handled properly\n- [ ] User deactivation sets `active: false` (not hard delete)\n- [ ] PATCH operations support `add`, `replace`, `remove` ops\n- [ ] Group push creates and manages group memberships\n- [ ] Okta SCIM validator test suite passes all tests\n- [ ] Error responses conform to SCIM error schema\n\n## References\n\n- [SCIM 2.0 Protocol RFC 7644](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7644)\n- [Okta SCIM Developer Guide](https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Fguides\u002Fscim-provisioning-integration-overview\u002Fmain\u002F)\n- [Build a SCIM API Service - Okta](https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Fguides\u002Fscim-provisioning-integration-prepare\u002Fmain\u002F)\n- [SCIM Core Schema RFC 7643](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7643)\n","# Implementing SCIM Provisioning with Okta\n\n## Overview\n\nSCIM (System for Cross-domain Identity Management) is an open standard protocol (RFC 7644) that automates the exchange of user identity information between identity providers like Okta and service providers. This skill covers building a SCIM 2.0-compliant API endpoint and integrating it with Okta for automated user lifecycle management including provisioning, deprovisioning, profile updates, and group management.\n\n\n## When to Use\n\n- When deploying or configuring implementing scim provisioning with okta capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Okta tenant with admin access (Developer or Production)\n- Application with REST API capable of user management\n- TLS-secured endpoint (HTTPS required)\n- Okta API token or OAuth 2.0 client credentials\n- Python 3.9+ with Flask or FastAPI\n\n## Core Concepts\n\n### SCIM 2.0 Protocol\n\nSCIM defines a standard schema for representing users and groups via JSON, with a RESTful API for CRUD operations:\n\n| Operation | HTTP Method | Endpoint | Description |\n|-----------|-------------|----------|-------------|\n| Create User | POST | \u002Fscim\u002Fv2\u002FUsers | Provisions a new user account |\n| Read User | GET | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Retrieves user details |\n| Update User | PUT\u002FPATCH | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Modifies user attributes |\n| Delete User | DELETE | \u002Fscim\u002Fv2\u002FUsers\u002F{id} | Removes user account |\n| List Users | GET | \u002Fscim\u002Fv2\u002FUsers | Lists users with filtering |\n| Create Group | POST | \u002Fscim\u002Fv2\u002FGroups | Creates a group |\n| Manage Group | PATCH | \u002Fscim\u002Fv2\u002FGroups\u002F{id} | Add\u002Fremove group members |\n\n### Okta SCIM Integration Architecture\n\n```\nOkta (IdP) ──SCIM 2.0 over HTTPS──> SCIM Server ──> Application Database\n     │                                     │\n     ├── User Assignment                   ├── Create\u002FUpdate User\n     ├── User Unassignment                 ├── Deactivate User\n     ├── Profile Push                      ├── Sync Attributes\n     └── Group Push                        └── Manage Groups\n```\n\n### Required SCIM Endpoints\n\n1. **ServiceProviderConfig** (`\u002Fscim\u002Fv2\u002FServiceProviderConfig`): Advertises SCIM capabilities\n2. **ResourceTypes** (`\u002Fscim\u002Fv2\u002FResourceTypes`): Describes supported resource types\n3. **Schemas** (`\u002Fscim\u002Fv2\u002FSchemas`): Publishes the SCIM schema definitions\n4. **Users** (`\u002Fscim\u002Fv2\u002FUsers`): User lifecycle operations\n5. **Groups** (`\u002Fscim\u002Fv2\u002FGroups`): Group management operations\n\n## Workflow\n\n### Step 1: Build SCIM 2.0 API Server\n\nCreate a Flask-based SCIM server that implements the core endpoints. The server must handle:\n\n- **User CRUD**: Create, read, update, delete, and list users\n- **Filtering**: Support `eq` filter on `userName` (required by Okta)\n- **Pagination**: Return `startIndex`, `itemsPerPage`, and `totalResults`\n- **Authentication**: Bearer token validation on all endpoints\n\n```python\nfrom flask import Flask, request, jsonify\nimport uuid\nfrom datetime import datetime\n\napp = Flask(__name__)\n\n# Bearer token for Okta authentication\nSCIM_BEARER_TOKEN = \"your-secure-token-here\"\n\ndef require_auth(f):\n    def wrapper(*args, **kwargs):\n        auth = request.headers.get(\"Authorization\", \"\")\n        if not auth.startswith(\"Bearer \") or auth[7:] != SCIM_BEARER_TOKEN:\n            return jsonify({\"detail\": \"Unauthorized\"}), 401\n        return f(*args, **kwargs)\n    wrapper.__name__ = f.__name__\n    return wrapper\n\n@app.route(\"\u002Fscim\u002Fv2\u002FUsers\", methods=[\"POST\"])\n@require_auth\ndef create_user():\n    data = request.json\n    user_id = str(uuid.uuid4())\n    user = {\n        \"schemas\": [\"urn:ietf:params:scim:schemas:core:2.0:User\"],\n        \"id\": user_id,\n        \"userName\": data.get(\"userName\"),\n        \"name\": data.get(\"name\", {}),\n        \"emails\": data.get(\"emails\", []),\n        \"active\": True,\n        \"meta\": {\n            \"resourceType\": \"User\",\n            \"created\": datetime.utcnow().isoformat() + \"Z\",\n            \"lastModified\": datetime.utcnow().isoformat() + \"Z\",\n            \"location\": f\"\u002Fscim\u002Fv2\u002FUsers\u002F{user_id}\"\n        }\n    }\n    # Persist user to database\n    return jsonify(user), 201\n\n@app.route(\"\u002Fscim\u002Fv2\u002FUsers\", methods=[\"GET\"])\n@require_auth\ndef list_users():\n    filter_param = request.args.get(\"filter\", \"\")\n    start_index = int(request.args.get(\"startIndex\", 1))\n    count = int(request.args.get(\"count\", 100))\n    # Parse filter: userName eq \"john@example.com\"\n    # Query database with filter\n    return jsonify({\n        \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:ListResponse\"],\n        \"totalResults\": 0,\n        \"startIndex\": start_index,\n        \"itemsPerPage\": count,\n        \"Resources\": []\n    })\n```\n\n### Step 2: Configure Okta Application\n\n1. **Create SCIM App Integration**:\n   - Navigate to Okta Admin Console > Applications > Create App Integration\n   - Select SWA or SAML 2.0 as sign-on method\n   - In the General tab, select SCIM for Provisioning\n\n2. **Configure SCIM Connection**:\n   - SCIM connector base URL: `https:\u002F\u002Fyour-app.com\u002Fscim\u002Fv2`\n   - Unique identifier field: `userName`\n   - Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups\n   - Authentication Mode: HTTP Header (Bearer Token)\n\n3. **Enable Provisioning Features**:\n   - To App: Create Users, Update User Attributes, Deactivate Users\n   - Configure attribute mappings between Okta profile and SCIM schema\n\n### Step 3: Map Attributes\n\nMap Okta user profile attributes to your SCIM schema:\n\n| Okta Attribute | SCIM Attribute | Direction |\n|---------------|----------------|-----------|\n| login | userName | Okta -> App |\n| firstName | name.givenName | Okta -> App |\n| lastName | name.familyName | Okta -> App |\n| email | emails[type eq \"work\"].value | Okta -> App |\n| department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department | Okta -> App |\n\n### Step 4: Implement Error Handling\n\nSCIM specifies standard error response format:\n\n```json\n{\n  \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:Error\"],\n  \"detail\": \"User already exists\",\n  \"status\": \"409\",\n  \"scimType\": \"uniqueness\"\n}\n```\n\nCommon error codes: 400 (Bad Request), 401 (Unauthorized), 404 (Not Found), 409 (Conflict), 500 (Internal Server Error).\n\n### Step 5: Test with Runscope\u002FOkta SCIM Validator\n\nOkta provides an automated SCIM test suite (via Runscope\u002FBlazeMeter) that validates your SCIM implementation against all required operations:\n\n1. Import the Okta SCIM 2.0 test suite from the OIN submission portal\n2. Configure the base URL and authentication token\n3. Run the full test suite covering user CRUD, filtering, and pagination\n4. Fix any failing tests before submitting to OIN\n\n## Validation Checklist\n\n- [ ] SCIM server accessible over HTTPS with valid TLS certificate\n- [ ] Bearer token authentication enforced on all endpoints\n- [ ] User creation returns 201 with full user representation\n- [ ] User search by `userName eq \"...\"` filter works correctly\n- [ ] Pagination parameters (`startIndex`, `count`) handled properly\n- [ ] User deactivation sets `active: false` (not hard delete)\n- [ ] PATCH operations support `add`, `replace`, `remove` ops\n- [ ] Group push creates and manages group memberships\n- [ ] Okta SCIM validator test suite passes all tests\n- [ ] Error responses conform to SCIM error schema\n\n## References\n\n- [SCIM 2.0 Protocol RFC 7644](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7644)\n- [Okta SCIM Developer Guide](https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Fguides\u002Fscim-provisioning-integration-overview\u002Fmain\u002F)\n- [Build a SCIM API Service - Okta](https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Fguides\u002Fscim-provisioning-integration-prepare\u002Fmain\u002F)\n- [SCIM Core Schema RFC 7643](https:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc7643)\n",{"name":5,"tags":49,"author":50,"domain":34,"license":15,"version":51,"mitre_f3":52,"nist_csf":75,"subdomain":80,"description":7,"mitre_attack":81},[29,26,25,28,42,36,35],"mahipal","1.0",{"tactics":53,"version":56,"techniques":57},[33,54,55],"positioning","resource-development","1.1",[58,62,66,69,72],{"id":59,"name":60,"source":61,"tactic":55},"T1586","Compromise Accounts","attack",{"id":63,"name":64,"source":65,"tactic":54},"F1005.002","Account Manipulation: Add Authorized User","f3",{"id":67,"name":68,"source":65,"tactic":54},"F1005.004","Account Manipulation: Change Account Details",{"id":70,"name":71,"source":65,"tactic":54},"F1042","Reactivate Account",{"id":73,"name":74,"source":65,"tactic":33},"F1006.002","Account Takeover: Exposed Login Credential",[76,77,78,79],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[82,83,84,85],"T1078","T1110","T1556","T1098","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-scim-provisioning-with-okta",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-scim-provisioning-with-okta",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-scim-provisioning-with-okta",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-scim-provisioning-with-okta","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002FSKILL.md",true,[110,116,121,127,131,135,141],{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"assets\u002Ftemplate.md","ASSET","资产文件",2541,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Fassets\u002Ftemplate.md",{"path":117,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002FLICENSE",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Fapi-reference.md","REFERENCE","参考文档",4722,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Freferences\u002Fapi-reference.md",{"path":128,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fstandards.md",2315,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Freferences\u002Fstandards.md",{"path":132,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fworkflows.md",2903,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Freferences\u002Fworkflows.md",{"path":136,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fagent.py","SCRIPT","脚本",9251,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Fscripts\u002Fagent.py",{"path":142,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Fprocess.py",15669,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-scim-provisioning-with-okta\u002Fscripts\u002Fprocess.py",[146,171,195,222,248,275],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,155,156,157,158,34,159,39,38,160,161,162,163,164,165,166,167,168,169,170],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[177],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[179,167,180,181,158,182,34,38,183,184,185,186,187,188,189,190,191,192,193,194],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":205,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[201,204],{"categoryNo":202,"categoryName":203,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,206,207,208,209,34,210,211,183,212,213,214,215,216,217,27,218,219,220,221],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[228],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,34,233,234,235,236,237,238,239,240,241,242,243,244,186,245,246,247],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[254],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[256,257,258,34,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":276,"name":277,"nameZh":6,"description":278,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":279,"categories":280,"keywords":282,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[281],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,283,34,284,285,286,287,288,289,290,291,27,292,218,293,294,295,296,297,298],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]