[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFFD9P6VK1K00DAF1F18AT":3,"skill-same:01M6AFFD9P6VK1K00DAF1F18AT":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AFFD9P6VK1K00DAF1F18AT","implementing-zero-standing-privilege-with-cyberark",null,"Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals). Use when designing or implementing zero standing privilege \u002F just-in-time privileged access models with CyberArk, or when replacing persistent cloud admin roles with time-bound, approval-gated sessions.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing zero standing privilege with cyberark","cyberark","ZeRO","least-privilege","jit-access","zero-standing-privilege","SCA","PAM","just-in-time","t1098","t1078","security","gcp","cloud-security","framework","pr","secure","identity","sessions","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-zero-standing-privilege-with-cyberark\ndescription: Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals). Use when designing or implementing zero standing privilege \u002F just-in-time privileged access models with CyberArk, or when replacing persistent cloud admin roles with time-bound, approval-gated sessions.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- cyberark\n- zero-standing-privilege\n- jit-access\n- pam\n- cloud-security\n- least-privilege\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n- T1078.004\n---\n\n# Implementing Zero Standing Privilege with CyberArk\n\n## Overview\n\nZero Standing Privileges (ZSP) is a security model where no user or identity retains persistent privileged access. Instead, elevated access is provisioned dynamically on a just-in-time (JIT) basis and automatically revoked after use. CyberArk implements ZSP through its Secure Cloud Access (SCA) module, which creates ephemeral, scoped roles in cloud environments (AWS, Azure, GCP) that exist only for the duration of a session. The TEA framework -- Time, Entitlements, and Approvals -- governs every privileged access session.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero standing privilege with cyberark capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- CyberArk Identity Security Platform (Privilege Cloud or self-hosted)\n- CyberArk Secure Cloud Access (SCA) license\n- Cloud provider accounts (AWS, Azure, GCP) with admin access for integration\n- ITSM integration (ServiceNow, Jira) for approval workflows\n- CyberArk Vault configured with safe management\n\n## Core Concepts\n\n### TEA Framework (Time, Entitlements, Approvals)\n\n| Component | Description | Configuration |\n|-----------|-------------|---------------|\n| **Time** | Duration of the privileged session | Min 15 minutes, max 8 hours, default 1 hour |\n| **Entitlements** | Permissions granted during the session | Dynamically scoped IAM roles\u002Fpolicies |\n| **Approvals** | Authorization workflow before access | Auto-approve, manager approval, or multi-level |\n\n### ZSP Architecture\n\n```\nUser requests access via CyberArk\n        │\n        ├── CyberArk evaluates request against policies:\n        │   ├── Is user eligible for this access?\n        │   ├── Does the request comply with TEA policies?\n        │   └── Is approval required?\n        │\n        ├── [If approval needed] → Route to approver (ITSM\u002FChatOps)\n        │\n        ├── Upon approval:\n        │   ├── CyberArk creates ephemeral IAM role in target cloud\n        │   ├── Scopes permissions to minimum required entitlements\n        │   ├── Sets session TTL (time-bound)\n        │   └── Provisions temporary credentials\n        │\n        ├── User accesses cloud resources via session\n        │   ├── All actions logged and recorded\n        │   └── Session monitored for policy violations\n        │\n        └── Session expires:\n            ├── Ephemeral role deleted\n            ├── Temporary credentials revoked\n            └── Zero standing privileges remain\n```\n\n### CyberArk Components\n\n| Component | Role |\n|-----------|------|\n| Identity Security Platform | Central management and policy engine |\n| Privilege Cloud Vault | Stores privileged credentials and keys |\n| Secure Cloud Access | Creates\u002Fdestroys ephemeral cloud roles |\n| Endpoint Privilege Manager | Controls local admin and app elevation |\n| Privileged Session Manager | Records and monitors privileged sessions |\n\n## Workflow\n\n### Step 1: Integrate Cloud Providers\n\n**AWS Integration:**\n1. Create a CyberArk integration role in AWS IAM\n2. Configure cross-account trust policy allowing CyberArk to assume roles\n3. Create IAM policies that define maximum allowed entitlements\n4. Register AWS accounts in CyberArk SCA\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n        \"Effect\": \"Allow\",\n        \"Principal\": {\n            \"AWS\": \"arn:aws:iam::CYBERARK_ACCOUNT:role\u002FCyberArkSCARole\"\n        },\n        \"Action\": \"sts:AssumeRole\",\n        \"Condition\": {\n            \"StringEquals\": {\n                \"sts:ExternalId\": \"cyberark-external-id\"\n            }\n        }\n    }]\n}\n```\n\n**Azure Integration:**\n1. Register CyberArk as an enterprise application in Microsoft Entra ID\n2. Grant CyberArk application permissions: Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory\n3. Create custom Azure roles with scoped permissions\n4. Register Azure subscriptions in CyberArk SCA\n\n**GCP Integration:**\n1. Create a service account for CyberArk in GCP\n2. Grant IAM Admin and Service Account Admin roles\n3. Configure workload identity federation for cross-cloud access\n4. Register GCP projects in CyberArk SCA\n\n### Step 2: Define Access Policies\n\nCreate policies that map job functions to cloud entitlements:\n\n```yaml\n# CyberArk SCA Policy Example\npolicy_name: \"developer-aws-read-access\"\ndescription: \"Read-only access to AWS production for developers\"\ntarget_cloud: \"aws\"\ntarget_accounts: [\"123456789012\", \"987654321098\"]\n\ntime_policy:\n  max_duration: \"4h\"\n  default_duration: \"1h\"\n  business_hours_only: true\n  timezone: \"America\u002FNew_York\"\n\nentitlement_policy:\n  aws_managed_policies:\n    - \"arn:aws:iam::aws:policy\u002FReadOnlyAccess\"\n  deny_actions:\n    - \"iam:*\"\n    - \"organizations:*\"\n    - \"sts:*\"\n  resource_restrictions:\n    - \"arn:aws:s3:::production-*\"\n\napproval_policy:\n  approval_required: true\n  approvers:\n    - type: \"manager\"\n    - type: \"group\"\n      group: \"cloud-security-team\"\n  auto_approve_conditions:\n    - previous_approved_same_policy: true\n      within_days: 7\n  escalation_timeout: \"2h\"\n  escalation_approver: \"cloud-security-lead\"\n```\n\n### Step 3: Configure Session Monitoring\n\nSet up privileged session recording and real-time monitoring:\n\n1. Enable session recording for all ZSP sessions\n2. Configure keystroke logging for SSH\u002FRDP sessions\n3. Set up real-time alerts for suspicious activities:\n   - Attempts to escalate privileges during session\n   - Access to resources outside policy scope\n   - Session duration exceeding 2x the normal pattern\n4. Forward session metadata to SIEM\n\n### Step 4: Implement Approval Workflows\n\nIntegrate with ITSM tools for access request and approval:\n\n- **ServiceNow**: CyberArk SCA connector creates ServiceNow tickets for approval\n- **Slack\u002FTeams**: ChatOps bot for quick approvals within messaging platforms\n- **Jira**: Integration for development-related access requests\n- **Auto-Approval**: Configure rules for low-risk, previously approved requests\n\n### Step 5: Migrate from Standing Privileges\n\n```\nPhase 1: DISCOVERY (Weeks 1-2)\n    ├── Inventory all standing privileged roles across cloud accounts\n    ├── Map users to their standing role assignments\n    ├── Analyze CloudTrail\u002Factivity logs for actual permission usage\n    └── Identify roles that can be converted to JIT\n\nPhase 2: POLICY CREATION (Weeks 3-4)\n    ├── Create ZSP policies based on actual usage analysis\n    ├── Define TEA parameters for each policy\n    ├── Configure approval workflows\n    └── Test policies with pilot users\n\nPhase 3: MIGRATION (Weeks 5-8)\n    ├── Assign ZSP policies to pilot group\n    ├── Remove standing privileges from pilot users\n    ├── Monitor for access issues and adjust policies\n    ├── Expand to additional teams incrementally\n    └── Remove all standing privileges organization-wide\n\nPhase 4: GOVERNANCE (Ongoing)\n    ├── Monthly review of ZSP policy effectiveness\n    ├── Quarterly entitlement optimization\n    ├── Monitor for policy drift or standing privilege re-creation\n    └── Report ZSP metrics to security leadership\n```\n\n## Validation Checklist\n\n- [ ] Cloud providers integrated with CyberArk SCA\n- [ ] TEA policies defined for all privileged access scenarios\n- [ ] Approval workflows configured and tested\n- [ ] Session recording and monitoring enabled\n- [ ] All standing privileged roles identified for migration\n- [ ] Pilot group successfully using ZSP without standing privileges\n- [ ] Break-glass procedure defined for emergency access\n- [ ] SIEM integration receiving session and access logs\n- [ ] Auto-approval rules configured for low-risk, repeat access\n- [ ] Organization-wide migration plan approved and scheduled\n- [ ] KPI tracking: reduction in standing privilege assignments\n\n## References\n\n- [CyberArk Zero Standing Privileges](https:\u002F\u002Fwww.cyberark.com\u002Fwhat-is\u002Fzero-standing-privileges\u002F)\n- [CyberArk ZSP Implementation with AWS](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fapn\u002Fhow-to-implement-zero-standing-privileges-with-cyberark-for-securing-access-to-the-aws-console\u002F)\n- [CyberArk Blueprint - Zero Standing Privilege](https:\u002F\u002Fdocs.cyberark.com\u002Fcyberark-blueprint\u002Flatest\u002Fen\u002Fcontent\u002Fzero-standing-privilege.htm)\n- [CyberArk Secure Cloud Access Documentation](https:\u002F\u002Fdocs.cyberark.com\u002Fispss-access\u002Flatest\u002Fen\u002Fcontent\u002Fgetstarted\u002Facc-frst-page.htm)\n","# Implementing Zero Standing Privilege with CyberArk\n\n## Overview\n\nZero Standing Privileges (ZSP) is a security model where no user or identity retains persistent privileged access. Instead, elevated access is provisioned dynamically on a just-in-time (JIT) basis and automatically revoked after use. CyberArk implements ZSP through its Secure Cloud Access (SCA) module, which creates ephemeral, scoped roles in cloud environments (AWS, Azure, GCP) that exist only for the duration of a session. The TEA framework -- Time, Entitlements, and Approvals -- governs every privileged access session.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero standing privilege with cyberark capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- CyberArk Identity Security Platform (Privilege Cloud or self-hosted)\n- CyberArk Secure Cloud Access (SCA) license\n- Cloud provider accounts (AWS, Azure, GCP) with admin access for integration\n- ITSM integration (ServiceNow, Jira) for approval workflows\n- CyberArk Vault configured with safe management\n\n## Core Concepts\n\n### TEA Framework (Time, Entitlements, Approvals)\n\n| Component | Description | Configuration |\n|-----------|-------------|---------------|\n| **Time** | Duration of the privileged session | Min 15 minutes, max 8 hours, default 1 hour |\n| **Entitlements** | Permissions granted during the session | Dynamically scoped IAM roles\u002Fpolicies |\n| **Approvals** | Authorization workflow before access | Auto-approve, manager approval, or multi-level |\n\n### ZSP Architecture\n\n```\nUser requests access via CyberArk\n        │\n        ├── CyberArk evaluates request against policies:\n        │   ├── Is user eligible for this access?\n        │   ├── Does the request comply with TEA policies?\n        │   └── Is approval required?\n        │\n        ├── [If approval needed] → Route to approver (ITSM\u002FChatOps)\n        │\n        ├── Upon approval:\n        │   ├── CyberArk creates ephemeral IAM role in target cloud\n        │   ├── Scopes permissions to minimum required entitlements\n        │   ├── Sets session TTL (time-bound)\n        │   └── Provisions temporary credentials\n        │\n        ├── User accesses cloud resources via session\n        │   ├── All actions logged and recorded\n        │   └── Session monitored for policy violations\n        │\n        └── Session expires:\n            ├── Ephemeral role deleted\n            ├── Temporary credentials revoked\n            └── Zero standing privileges remain\n```\n\n### CyberArk Components\n\n| Component | Role |\n|-----------|------|\n| Identity Security Platform | Central management and policy engine |\n| Privilege Cloud Vault | Stores privileged credentials and keys |\n| Secure Cloud Access | Creates\u002Fdestroys ephemeral cloud roles |\n| Endpoint Privilege Manager | Controls local admin and app elevation |\n| Privileged Session Manager | Records and monitors privileged sessions |\n\n## Workflow\n\n### Step 1: Integrate Cloud Providers\n\n**AWS Integration:**\n1. Create a CyberArk integration role in AWS IAM\n2. Configure cross-account trust policy allowing CyberArk to assume roles\n3. Create IAM policies that define maximum allowed entitlements\n4. Register AWS accounts in CyberArk SCA\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n        \"Effect\": \"Allow\",\n        \"Principal\": {\n            \"AWS\": \"arn:aws:iam::CYBERARK_ACCOUNT:role\u002FCyberArkSCARole\"\n        },\n        \"Action\": \"sts:AssumeRole\",\n        \"Condition\": {\n            \"StringEquals\": {\n                \"sts:ExternalId\": \"cyberark-external-id\"\n            }\n        }\n    }]\n}\n```\n\n**Azure Integration:**\n1. Register CyberArk as an enterprise application in Microsoft Entra ID\n2. Grant CyberArk application permissions: Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory\n3. Create custom Azure roles with scoped permissions\n4. Register Azure subscriptions in CyberArk SCA\n\n**GCP Integration:**\n1. Create a service account for CyberArk in GCP\n2. Grant IAM Admin and Service Account Admin roles\n3. Configure workload identity federation for cross-cloud access\n4. Register GCP projects in CyberArk SCA\n\n### Step 2: Define Access Policies\n\nCreate policies that map job functions to cloud entitlements:\n\n```yaml\n# CyberArk SCA Policy Example\npolicy_name: \"developer-aws-read-access\"\ndescription: \"Read-only access to AWS production for developers\"\ntarget_cloud: \"aws\"\ntarget_accounts: [\"123456789012\", \"987654321098\"]\n\ntime_policy:\n  max_duration: \"4h\"\n  default_duration: \"1h\"\n  business_hours_only: true\n  timezone: \"America\u002FNew_York\"\n\nentitlement_policy:\n  aws_managed_policies:\n    - \"arn:aws:iam::aws:policy\u002FReadOnlyAccess\"\n  deny_actions:\n    - \"iam:*\"\n    - \"organizations:*\"\n    - \"sts:*\"\n  resource_restrictions:\n    - \"arn:aws:s3:::production-*\"\n\napproval_policy:\n  approval_required: true\n  approvers:\n    - type: \"manager\"\n    - type: \"group\"\n      group: \"cloud-security-team\"\n  auto_approve_conditions:\n    - previous_approved_same_policy: true\n      within_days: 7\n  escalation_timeout: \"2h\"\n  escalation_approver: \"cloud-security-lead\"\n```\n\n### Step 3: Configure Session Monitoring\n\nSet up privileged session recording and real-time monitoring:\n\n1. Enable session recording for all ZSP sessions\n2. Configure keystroke logging for SSH\u002FRDP sessions\n3. Set up real-time alerts for suspicious activities:\n   - Attempts to escalate privileges during session\n   - Access to resources outside policy scope\n   - Session duration exceeding 2x the normal pattern\n4. Forward session metadata to SIEM\n\n### Step 4: Implement Approval Workflows\n\nIntegrate with ITSM tools for access request and approval:\n\n- **ServiceNow**: CyberArk SCA connector creates ServiceNow tickets for approval\n- **Slack\u002FTeams**: ChatOps bot for quick approvals within messaging platforms\n- **Jira**: Integration for development-related access requests\n- **Auto-Approval**: Configure rules for low-risk, previously approved requests\n\n### Step 5: Migrate from Standing Privileges\n\n```\nPhase 1: DISCOVERY (Weeks 1-2)\n    ├── Inventory all standing privileged roles across cloud accounts\n    ├── Map users to their standing role assignments\n    ├── Analyze CloudTrail\u002Factivity logs for actual permission usage\n    └── Identify roles that can be converted to JIT\n\nPhase 2: POLICY CREATION (Weeks 3-4)\n    ├── Create ZSP policies based on actual usage analysis\n    ├── Define TEA parameters for each policy\n    ├── Configure approval workflows\n    └── Test policies with pilot users\n\nPhase 3: MIGRATION (Weeks 5-8)\n    ├── Assign ZSP policies to pilot group\n    ├── Remove standing privileges from pilot users\n    ├── Monitor for access issues and adjust policies\n    ├── Expand to additional teams incrementally\n    └── Remove all standing privileges organization-wide\n\nPhase 4: GOVERNANCE (Ongoing)\n    ├── Monthly review of ZSP policy effectiveness\n    ├── Quarterly entitlement optimization\n    ├── Monitor for policy drift or standing privilege re-creation\n    └── Report ZSP metrics to security leadership\n```\n\n## Validation Checklist\n\n- [ ] Cloud providers integrated with CyberArk SCA\n- [ ] TEA policies defined for all privileged access scenarios\n- [ ] Approval workflows configured and tested\n- [ ] Session recording and monitoring enabled\n- [ ] All standing privileged roles identified for migration\n- [ ] Pilot group successfully using ZSP without standing privileges\n- [ ] Break-glass procedure defined for emergency access\n- [ ] SIEM integration receiving session and access logs\n- [ ] Auto-approval rules configured for low-risk, repeat access\n- [ ] Organization-wide migration plan approved and scheduled\n- [ ] KPI tracking: reduction in standing privilege assignments\n\n## References\n\n- [CyberArk Zero Standing Privileges](https:\u002F\u002Fwww.cyberark.com\u002Fwhat-is\u002Fzero-standing-privileges\u002F)\n- [CyberArk ZSP Implementation with AWS](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fapn\u002Fhow-to-implement-zero-standing-privileges-with-cyberark-for-securing-access-to-the-aws-console\u002F)\n- [CyberArk Blueprint - Zero Standing Privilege](https:\u002F\u002Fdocs.cyberark.com\u002Fcyberark-blueprint\u002Flatest\u002Fen\u002Fcontent\u002Fzero-standing-privilege.htm)\n- [CyberArk Secure Cloud Access Documentation](https:\u002F\u002Fdocs.cyberark.com\u002Fispss-access\u002Flatest\u002Fen\u002Fcontent\u002Fgetstarted\u002Facc-frst-page.htm)\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[25,29,28,50,37,27],"pam","mahipal","1.0",[54,55,56,57],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[60,61,62,63,64],"T1078","T1110","T1556","T1098","T1078.004","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-zero-standing-privilege-with-cyberark",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-standing-privilege-with-cyberark",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-standing-privilege-with-cyberark",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-standing-privilege-with-cyberark","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",1254,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1705,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",1675,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",3705,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",7235,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",7038,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-standing-privilege-with-cyberark\u002Fscripts\u002Fprocess.py",[125,149,172,199,225,251],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135,136,35,43,137,41,39,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,35,160,43,39,161,26,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,183,184,185,186,43,187,188,161,189,190,191,192,193,194,34,195,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,43,210,211,212,213,214,215,216,217,218,219,220,221,163,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,38,234,43,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,259,43,260,261,262,263,264,265,266,267,34,268,195,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]