[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFDTJ0H7WGPS5FK2VA4ZX0":3,"skill-same:01M6AFDTJ0H7WGPS5FK2VA4ZX0":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AFDTJ0H7WGPS5FK2VA4ZX0","implementing-soar-playbook-with-palo-alto-xsoar",null,"Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools. Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration commands or Python automation scripts, or reducing manual SOC response time via orchestration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing soar playbook with palo alto xsoar","soar","playbook","soc","cortex","xsoar","ddos","t1566","Tools","t1078","palo-alto","python","phishing","malware","orchestrate","workflows","automation","orchestration","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-soar-playbook-with-palo-alto-xsoar\ndescription: Build automated incident response playbooks in Cortex XSOAR (Demisto)\n  using its YAML playbook structure, integration commands, and task types to orchestrate\n  phishing, malware, account-compromise, and DDoS response workflows across SOC tools.\n  Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration\n  commands or Python automation scripts, or reducing manual SOC response time via\n  orchestration.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- xsoar\n- soar\n- palo-alto\n- playbook\n- automation\n- incident-response\n- orchestration\n- cortex\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\n---\n\n# Implementing SOAR Playbook with Palo Alto XSOAR\n\n## Overview\n\nCortex XSOAR (formerly Demisto) is Palo Alto Networks' Security Orchestration, Automation, and Response platform. Playbooks are the core automation engine in XSOAR, enabling SOC teams to automate repetitive incident response tasks. XSOAR provides 900+ prebuilt integration packs, 87 common playbooks, and a visual drag-and-drop editor for building custom workflows. Organizations using SOAR automation reduce mean time to respond (MTTR) by 80% on average.\n\n\n## When to Use\n\n- When deploying or configuring implementing soar playbook with palo alto xsoar capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cortex XSOAR deployed (version 8.x or later, or XSOAR hosted)\n- Administrative access for playbook creation\n- Integration packs installed for relevant security tools\n- Incident types and layouts configured\n- API access to external tools (SIEM, EDR, TI platforms, ticketing)\n\n## Playbook Architecture\n\n### XSOAR Component Hierarchy\n\n```\nIncident Type (e.g., Phishing)\n    |\n    v\nIncident Layout (UI display configuration)\n    |\n    v\nPre-Processing Rules (auto-classification, deduplication)\n    |\n    v\nPlaybook (automation logic)\n    |-- Sub-Playbooks (modular reusable workflows)\n    |-- Tasks (individual automation steps)\n    |-- Conditional Tasks (decision branches)\n    |-- Scripts (custom Python\u002FJavaScript)\n    |-- Integrations (external tool commands)\n    |\n    v\nWar Room (investigation timeline)\n    |\n    v\nClosing Report\n```\n\n### Playbook Task Types\n\n| Task Type | Purpose | Example |\n|---|---|---|\n| Standard | Execute a command | `!ip ip=8.8.8.8` |\n| Conditional | Branch logic | If severity > high, escalate |\n| Manual | Require analyst input | Approve containment action |\n| Section Header | Organize workflow | \"Enrichment Phase\" |\n| Data Collection | Gather external data | Ask user for additional details |\n| Timer | Wait for condition\u002Ftime | Wait 5 minutes then check |\n\n## Building a Phishing Response Playbook\n\n### Step 1: Define Incident Type\n\n```yaml\nincident_type: Phishing\nplaybook: Phishing Investigation - Full\nseverity_mapping:\n  - condition: email contains executable attachment\n    severity: high\n  - condition: email from external domain with link\n    severity: medium\n  - condition: email reported by user\n    severity: low\nlayout: Phishing Layout\nsla: 60 minutes\n```\n\n### Step 2: Playbook YAML Structure\n\n```yaml\nid: phishing-investigation-full\nversion: -1\nname: Phishing Investigation - Full\ndescription: Automated phishing email investigation with enrichment, analysis, and response\nstarttaskid: \"0\"\ntasks:\n  \"0\":\n    id: \"0\"\n    taskid: start\n    type: start\n    nexttasks:\n      '#none#':\n      - \"1\"\n  \"1\":\n    id: \"1\"\n    taskid: extract-indicators\n    type: regular\n    task:\n      name: Extract Indicators from Email\n      script: ParseEmailFiles\n    nexttasks:\n      '#none#':\n      - \"2\"\n      - \"3\"\n      - \"4\"\n  \"2\":\n    id: \"2\"\n    taskid: enrich-urls\n    type: playbook\n    task:\n      name: URL Enrichment\n      playbookName: URL Enrichment - Generic v2\n  \"3\":\n    id: \"3\"\n    taskid: enrich-files\n    type: playbook\n    task:\n      name: File Enrichment\n      playbookName: File Enrichment - Generic v2\n  \"4\":\n    id: \"4\"\n    taskid: enrich-ips\n    type: playbook\n    task:\n      name: IP Enrichment\n      playbookName: IP Enrichment - Generic v2\n  \"5\":\n    id: \"5\"\n    taskid: determine-verdict\n    type: condition\n    task:\n      name: Is Email Malicious?\n    conditions:\n      - label: \"yes\"\n        condition:\n          - - operator: isEqualString\n              left: DBotScore.Score\n              right: \"3\"\n      - label: \"no\"\n    nexttasks:\n      \"yes\":\n      - \"6\"\n      \"no\":\n      - \"9\"\n  \"6\":\n    id: \"6\"\n    taskid: block-sender\n    type: regular\n    task:\n      name: Block Sender Domain\n      script: '|||o365-mail-block-sender'\n    scriptarguments:\n      sender_address: ${incident.emailfrom}\n  \"7\":\n    id: \"7\"\n    taskid: search-mailboxes\n    type: regular\n    task:\n      name: Search and Delete from All Mailboxes\n      script: '|||o365-mail-purge-compliance-search'\n    scriptarguments:\n      query: \"from:${incident.emailfrom} subject:${incident.emailsubject}\"\n  \"8\":\n    id: \"8\"\n    taskid: notify-user\n    type: regular\n    task:\n      name: Notify Reporting User\n      script: '|||send-mail'\n    scriptarguments:\n      to: ${incident.reporter}\n      subject: \"Phishing Report Confirmed - Action Taken\"\n      body: \"The email you reported has been confirmed as malicious and removed.\"\n  \"9\":\n    id: \"9\"\n    taskid: close-incident\n    type: regular\n    task:\n      name: Close Incident\n      script: closeInvestigation\n```\n\n### Step 3: Integration Commands\n\n#### Email Analysis\n```\n!ParseEmailFiles entryid=${File.EntryID}\n!rasterize url=${URL.Data} type=png\n```\n\n#### Threat Intelligence Enrichment\n```\n!url url=${URL.Data}\n!file file=${File.SHA256}\n!ip ip=${IP.Address}\n!domain domain=${Domain.Name}\n```\n\n#### Containment Actions\n```\n!o365-mail-block-sender sender=${incident.emailfrom}\n!o365-mail-purge-compliance-search query=\"from:${incident.emailfrom}\"\n!pan-os-block-ip ip=${IP.Address} log_forwarding=\"default\"\n!cortex-xdr-isolate-endpoint endpoint_id=${Endpoint.ID}\n```\n\n#### Ticketing Integration\n```\n!jira-create-issue summary=\"Phishing Incident - ${incident.id}\" type=\"Incident\" priority=\"High\"\n!servicenow-create-ticket short_description=\"Security Incident\" urgency=\"2\"\n```\n\n## Common SOC Playbook Templates\n\n### 1. Malware Investigation Playbook\n\n```\nTrigger: Malware alert from EDR\nSteps:\n  1. Extract file hash, process details, host info\n  2. Enrich hash via VirusTotal, Hybrid Analysis\n  3. Check if file is on allowlist\n  4. If malicious:\n     a. Isolate endpoint via EDR\n     b. Block hash on all endpoints\n     c. Search for hash across environment\n     d. Create incident ticket\n  5. If clean: Close as false positive\n```\n\n### 2. Account Compromise Playbook\n\n```\nTrigger: Impossible travel or suspicious login alert\nSteps:\n  1. Get user details from Active Directory\n  2. Get login history for past 30 days\n  3. Check for impossible travel (geo-distance vs time)\n  4. Check for known VPN\u002Fproxy IP\n  5. If compromised:\n     a. Disable AD account\n     b. Revoke all OAuth tokens\n     c. Reset MFA\n     d. Notify user's manager\n     e. Search for lateral movement\n  6. If false positive: Document and close\n```\n\n### 3. DDoS Mitigation Playbook\n\n```\nTrigger: Network anomaly alert\nSteps:\n  1. Verify traffic spike from network monitoring\n  2. Identify source IPs and geolocation\n  3. Check if source IPs are known botnets\n  4. Implement rate limiting on WAF\n  5. If sustained attack:\n     a. Enable upstream DDoS protection\n     b. Activate CDN scrubbing\n     c. Notify ISP if needed\n  6. Monitor and document\n```\n\n## Custom XSOAR Scripts\n\n### Python Automation Script Example\n\n```python\n# XSOAR Automation Script: CalculateRiskScore\ndef calculate_risk_score():\n    \"\"\"Calculate composite risk score for an incident.\"\"\"\n    severity = demisto.incident().get('severity', 0)\n    indicator_count = len(demisto.get(demisto.context(), 'DBotScore', []))\n    malicious_count = len([\n        i for i in demisto.get(demisto.context(), 'DBotScore', [])\n        if i.get('Score', 0) == 3\n    ])\n\n    base_score = severity * 20\n    indicator_boost = min(indicator_count * 5, 25)\n    malicious_boost = malicious_count * 15\n\n    risk_score = min(100, base_score + indicator_boost + malicious_boost)\n\n    return_results(CommandResults(\n        outputs_prefix='RiskScore',\n        outputs={'Score': risk_score, 'Level': 'Critical' if risk_score > 80 else 'High' if risk_score > 60 else 'Medium'},\n        readable_output=f'Risk Score: {risk_score}\u002F100'\n    ))\n\ncalculate_risk_score()\n```\n\n## Playbook Performance Metrics\n\n| Metric | Before SOAR | After SOAR | Improvement |\n|---|---|---|---|\n| Phishing MTTR | 45 min | 5 min | 89% reduction |\n| Malware MTTR | 60 min | 8 min | 87% reduction |\n| Account Compromise MTTR | 30 min | 4 min | 87% reduction |\n| Alerts Handled per Shift | 50 | 200+ | 300% increase |\n| False Positive Handling | 10 min | 30 sec | 95% reduction |\n\n## References\n\n- [Cortex XSOAR Playbooks Overview](https:\u002F\u002Fxsoar.pan.dev\u002Fdocs\u002Fplaybooks\u002Fplaybooks-overview)\n- [From Zero to Process to XSOAR Playbook](https:\u002F\u002Flive.paloaltonetworks.com\u002Ft5\u002Fcommunity-blogs\u002Ffrom-zero-to-process-to-xsoar-playbook\u002Fba-p\u002F564568)\n- [XSOAR Common Playbooks Pack](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fblog\u002Fsecurity-operations\u002Fplaybook-of-the-week-xsoar-common-playbook\u002F)\n- [Cortex XSOAR Product Page](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsoar)\n","# Implementing SOAR Playbook with Palo Alto XSOAR\n\n## Overview\n\nCortex XSOAR (formerly Demisto) is Palo Alto Networks' Security Orchestration, Automation, and Response platform. Playbooks are the core automation engine in XSOAR, enabling SOC teams to automate repetitive incident response tasks. XSOAR provides 900+ prebuilt integration packs, 87 common playbooks, and a visual drag-and-drop editor for building custom workflows. Organizations using SOAR automation reduce mean time to respond (MTTR) by 80% on average.\n\n\n## When to Use\n\n- When deploying or configuring implementing soar playbook with palo alto xsoar capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cortex XSOAR deployed (version 8.x or later, or XSOAR hosted)\n- Administrative access for playbook creation\n- Integration packs installed for relevant security tools\n- Incident types and layouts configured\n- API access to external tools (SIEM, EDR, TI platforms, ticketing)\n\n## Playbook Architecture\n\n### XSOAR Component Hierarchy\n\n```\nIncident Type (e.g., Phishing)\n    |\n    v\nIncident Layout (UI display configuration)\n    |\n    v\nPre-Processing Rules (auto-classification, deduplication)\n    |\n    v\nPlaybook (automation logic)\n    |-- Sub-Playbooks (modular reusable workflows)\n    |-- Tasks (individual automation steps)\n    |-- Conditional Tasks (decision branches)\n    |-- Scripts (custom Python\u002FJavaScript)\n    |-- Integrations (external tool commands)\n    |\n    v\nWar Room (investigation timeline)\n    |\n    v\nClosing Report\n```\n\n### Playbook Task Types\n\n| Task Type | Purpose | Example |\n|---|---|---|\n| Standard | Execute a command | `!ip ip=8.8.8.8` |\n| Conditional | Branch logic | If severity > high, escalate |\n| Manual | Require analyst input | Approve containment action |\n| Section Header | Organize workflow | \"Enrichment Phase\" |\n| Data Collection | Gather external data | Ask user for additional details |\n| Timer | Wait for condition\u002Ftime | Wait 5 minutes then check |\n\n## Building a Phishing Response Playbook\n\n### Step 1: Define Incident Type\n\n```yaml\nincident_type: Phishing\nplaybook: Phishing Investigation - Full\nseverity_mapping:\n  - condition: email contains executable attachment\n    severity: high\n  - condition: email from external domain with link\n    severity: medium\n  - condition: email reported by user\n    severity: low\nlayout: Phishing Layout\nsla: 60 minutes\n```\n\n### Step 2: Playbook YAML Structure\n\n```yaml\nid: phishing-investigation-full\nversion: -1\nname: Phishing Investigation - Full\ndescription: Automated phishing email investigation with enrichment, analysis, and response\nstarttaskid: \"0\"\ntasks:\n  \"0\":\n    id: \"0\"\n    taskid: start\n    type: start\n    nexttasks:\n      '#none#':\n      - \"1\"\n  \"1\":\n    id: \"1\"\n    taskid: extract-indicators\n    type: regular\n    task:\n      name: Extract Indicators from Email\n      script: ParseEmailFiles\n    nexttasks:\n      '#none#':\n      - \"2\"\n      - \"3\"\n      - \"4\"\n  \"2\":\n    id: \"2\"\n    taskid: enrich-urls\n    type: playbook\n    task:\n      name: URL Enrichment\n      playbookName: URL Enrichment - Generic v2\n  \"3\":\n    id: \"3\"\n    taskid: enrich-files\n    type: playbook\n    task:\n      name: File Enrichment\n      playbookName: File Enrichment - Generic v2\n  \"4\":\n    id: \"4\"\n    taskid: enrich-ips\n    type: playbook\n    task:\n      name: IP Enrichment\n      playbookName: IP Enrichment - Generic v2\n  \"5\":\n    id: \"5\"\n    taskid: determine-verdict\n    type: condition\n    task:\n      name: Is Email Malicious?\n    conditions:\n      - label: \"yes\"\n        condition:\n          - - operator: isEqualString\n              left: DBotScore.Score\n              right: \"3\"\n      - label: \"no\"\n    nexttasks:\n      \"yes\":\n      - \"6\"\n      \"no\":\n      - \"9\"\n  \"6\":\n    id: \"6\"\n    taskid: block-sender\n    type: regular\n    task:\n      name: Block Sender Domain\n      script: '|||o365-mail-block-sender'\n    scriptarguments:\n      sender_address: ${incident.emailfrom}\n  \"7\":\n    id: \"7\"\n    taskid: search-mailboxes\n    type: regular\n    task:\n      name: Search and Delete from All Mailboxes\n      script: '|||o365-mail-purge-compliance-search'\n    scriptarguments:\n      query: \"from:${incident.emailfrom} subject:${incident.emailsubject}\"\n  \"8\":\n    id: \"8\"\n    taskid: notify-user\n    type: regular\n    task:\n      name: Notify Reporting User\n      script: '|||send-mail'\n    scriptarguments:\n      to: ${incident.reporter}\n      subject: \"Phishing Report Confirmed - Action Taken\"\n      body: \"The email you reported has been confirmed as malicious and removed.\"\n  \"9\":\n    id: \"9\"\n    taskid: close-incident\n    type: regular\n    task:\n      name: Close Incident\n      script: closeInvestigation\n```\n\n### Step 3: Integration Commands\n\n#### Email Analysis\n```\n!ParseEmailFiles entryid=${File.EntryID}\n!rasterize url=${URL.Data} type=png\n```\n\n#### Threat Intelligence Enrichment\n```\n!url url=${URL.Data}\n!file file=${File.SHA256}\n!ip ip=${IP.Address}\n!domain domain=${Domain.Name}\n```\n\n#### Containment Actions\n```\n!o365-mail-block-sender sender=${incident.emailfrom}\n!o365-mail-purge-compliance-search query=\"from:${incident.emailfrom}\"\n!pan-os-block-ip ip=${IP.Address} log_forwarding=\"default\"\n!cortex-xdr-isolate-endpoint endpoint_id=${Endpoint.ID}\n```\n\n#### Ticketing Integration\n```\n!jira-create-issue summary=\"Phishing Incident - ${incident.id}\" type=\"Incident\" priority=\"High\"\n!servicenow-create-ticket short_description=\"Security Incident\" urgency=\"2\"\n```\n\n## Common SOC Playbook Templates\n\n### 1. Malware Investigation Playbook\n\n```\nTrigger: Malware alert from EDR\nSteps:\n  1. Extract file hash, process details, host info\n  2. Enrich hash via VirusTotal, Hybrid Analysis\n  3. Check if file is on allowlist\n  4. If malicious:\n     a. Isolate endpoint via EDR\n     b. Block hash on all endpoints\n     c. Search for hash across environment\n     d. Create incident ticket\n  5. If clean: Close as false positive\n```\n\n### 2. Account Compromise Playbook\n\n```\nTrigger: Impossible travel or suspicious login alert\nSteps:\n  1. Get user details from Active Directory\n  2. Get login history for past 30 days\n  3. Check for impossible travel (geo-distance vs time)\n  4. Check for known VPN\u002Fproxy IP\n  5. If compromised:\n     a. Disable AD account\n     b. Revoke all OAuth tokens\n     c. Reset MFA\n     d. Notify user's manager\n     e. Search for lateral movement\n  6. If false positive: Document and close\n```\n\n### 3. DDoS Mitigation Playbook\n\n```\nTrigger: Network anomaly alert\nSteps:\n  1. Verify traffic spike from network monitoring\n  2. Identify source IPs and geolocation\n  3. Check if source IPs are known botnets\n  4. Implement rate limiting on WAF\n  5. If sustained attack:\n     a. Enable upstream DDoS protection\n     b. Activate CDN scrubbing\n     c. Notify ISP if needed\n  6. Monitor and document\n```\n\n## Custom XSOAR Scripts\n\n### Python Automation Script Example\n\n```python\n# XSOAR Automation Script: CalculateRiskScore\ndef calculate_risk_score():\n    \"\"\"Calculate composite risk score for an incident.\"\"\"\n    severity = demisto.incident().get('severity', 0)\n    indicator_count = len(demisto.get(demisto.context(), 'DBotScore', []))\n    malicious_count = len([\n        i for i in demisto.get(demisto.context(), 'DBotScore', [])\n        if i.get('Score', 0) == 3\n    ])\n\n    base_score = severity * 20\n    indicator_boost = min(indicator_count * 5, 25)\n    malicious_boost = malicious_count * 15\n\n    risk_score = min(100, base_score + indicator_boost + malicious_boost)\n\n    return_results(CommandResults(\n        outputs_prefix='RiskScore',\n        outputs={'Score': risk_score, 'Level': 'Critical' if risk_score > 80 else 'High' if risk_score > 60 else 'Medium'},\n        readable_output=f'Risk Score: {risk_score}\u002F100'\n    ))\n\ncalculate_risk_score()\n```\n\n## Playbook Performance Metrics\n\n| Metric | Before SOAR | After SOAR | Improvement |\n|---|---|---|---|\n| Phishing MTTR | 45 min | 5 min | 89% reduction |\n| Malware MTTR | 60 min | 8 min | 87% reduction |\n| Account Compromise MTTR | 30 min | 4 min | 87% reduction |\n| Alerts Handled per Shift | 50 | 200+ | 300% increase |\n| False Positive Handling | 10 min | 30 sec | 95% reduction |\n\n## References\n\n- [Cortex XSOAR Playbooks Overview](https:\u002F\u002Fxsoar.pan.dev\u002Fdocs\u002Fplaybooks\u002Fplaybooks-overview)\n- [From Zero to Process to XSOAR Playbook](https:\u002F\u002Flive.paloaltonetworks.com\u002Ft5\u002Fcommunity-blogs\u002Ffrom-zero-to-process-to-xsoar-playbook\u002Fba-p\u002F564568)\n- [XSOAR Common Playbooks Pack](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fblog\u002Fsecurity-operations\u002Fplaybook-of-the-week-xsoar-common-playbook\u002F)\n- [Cortex XSOAR Product Page](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsoar)\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[29,25,34,26,40,50,41,28],"incident-response","mahipal","1.0",[54,55,56,57],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[60,61,62,63],"T1078","T1685.002","T1685.005","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-playbook-with-palo-alto-xsoar",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-playbook-with-palo-alto-xsoar",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-playbook-with-palo-alto-xsoar","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",1408,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",4203,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",1761,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",2043,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",7525,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",10081,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-playbook-with-palo-alto-xsoar\u002Fscripts\u002Fprocess.py",[124,150,173,199,225,252],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,136,43,42,137,138,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,136,161,43,138,162,163,164,32,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,43,188,189,162,190,191,50,192,193,194,33,195,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,43,210,211,212,213,214,215,216,217,218,219,220,221,32,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,43,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,260,43,261,262,263,27,264,265,266,267,33,268,195,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]