[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFG4QPT7RT4CR9A22CATSX":3,"skill-same:01M6AFG4QPT7RT4CR9A22CATSX":144},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":85,"commitSha":86,"skillDirectory":87,"forksCount":88,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":92,"ownerDescription":93,"updatedAt":94,"install":95,"resources":108},"01M6AFG4QPT7RT4CR9A22CATSX","implementing-zero-trust-with-hashicorp-boundary",null,"Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller\u002Fworker setup, Vault-backed credential brokering, session recording, and OIDC\u002FLDAP auth across an org\u002Fproject scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"implementing zero trust with hashicorp boundary","ZeRO","identity-aware","session-recording","just-in-time-access","privileged-access","just-in-time","initial-access","Tools","t1078","t1003","cybersecurity","zero-trust","controller","network","infrastructure","pr","identity","architecture","auth","2026-11-10 10:12:30",false,"---\nname: implementing-zero-trust-with-hashicorp-boundary\ndescription: Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller\u002Fworker setup, Vault-backed credential brokering, session recording, and OIDC\u002FLDAP auth across an org\u002Fproject scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- hashicorp\n- boundary\n- privileged-access\n- vault\n- identity-aware-proxy\n- session-recording\n- just-in-time-access\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1003\n- T1110\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - resource-development\n  techniques:\n  - id: T1586\n    name: Compromise Accounts\n    tactic: resource-development\n    source: attack\n  - id: T1110\n    name: Brute Force\n    tactic: initial-access\n    source: attack\n  - id: T1110.004\n    name: 'Brute Force:  Credential Stuffing'\n    tactic: initial-access\n    source: attack\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n  - id: F1033\n    name: Insider Access Abuse\n    tactic: initial-access\n    source: f3\n---\n\n# Implementing Zero Trust with HashiCorp Boundary\n\n## Overview\n\nHashiCorp Boundary is an identity-aware proxy that provides secure, zero trust access to infrastructure resources without traditional VPNs or direct network access. Boundary operates on a default-deny model -- users start with no access and must be explicitly granted permissions for specific resources. When integrated with HashiCorp Vault, Boundary can dynamically broker credentials, ensuring users never see or manage underlying secrets. This eliminates credential sprawl and enables just-in-time access with automatic credential revocation when sessions end. Boundary supports session recording for audit compliance, OIDC\u002FLDAP authentication, and manages access through a hierarchical scope model of organizations and projects.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero trust with hashicorp boundary capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- HashiCorp Boundary server (self-hosted or HCP Boundary)\n- HashiCorp Vault (for credential brokering)\n- Identity provider supporting OIDC (Okta, Azure AD, Auth0)\n- PostgreSQL database for Boundary's backend\n- TLS certificates for secure communication\n- Understanding of PKI and X.509 certificate management\n\n## Architecture\n\n```\n                    Identity Provider (OIDC)\n                           |\n                    Authentication\n                           |\n                  +--------+--------+\n                  |   Boundary      |\n                  |   Controller    |\n                  |  (Control Plane)|\n                  +--------+--------+\n                           |\n              +------------+------------+\n              |                         |\n     +--------+--------+      +--------+--------+\n     | Boundary Worker |      | Boundary Worker |\n     | (Data Plane)    |      | (Data Plane)    |\n     +--------+--------+      +--------+--------+\n              |                         |\n     +--------+--------+      +--------+--------+\n     |  Target Hosts   |      |  Target Hosts   |\n     |  (SSH, RDP,     |      |  (Databases,    |\n     |   K8s, HTTP)    |      |   APIs)         |\n     +-----------------+      +-----------------+\n\n     Vault (Credential Brokering)\n     - Dynamic database credentials\n     - SSH certificate signing\n     - Credential libraries\n```\n\n## Installation and Configuration\n\n### Boundary Server Setup\n\n```bash\n# Install Boundary\ncurl -fsSL https:\u002F\u002Fapt.releases.hashicorp.com\u002Fgpg | sudo apt-key add -\nsudo apt-add-repository \"deb [arch=amd64] https:\u002F\u002Fapt.releases.hashicorp.com $(lsb_release -cs) main\"\nsudo apt-get update && sudo apt-get install boundary\n\n# Initialize the database\nboundary database init \\\n  -config=\u002Fetc\u002Fboundary\u002Fcontroller.hcl\n\n# Start the controller\nboundary server -config=\u002Fetc\u002Fboundary\u002Fcontroller.hcl\n```\n\n### Controller Configuration\n\n```hcl\n# \u002Fetc\u002Fboundary\u002Fcontroller.hcl\ncontroller {\n  name = \"boundary-controller-1\"\n  description = \"Primary Boundary Controller\"\n  database {\n    url = \"postgresql:\u002F\u002Fboundary:password@localhost:5432\u002Fboundary?sslmode=require\"\n  }\n  public_cluster_addr = \"boundary.example.com\"\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9200\"\n  purpose = \"api\"\n  tls_cert_file = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fcert.pem\"\n  tls_key_file  = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fkey.pem\"\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9201\"\n  purpose = \"cluster\"\n  tls_cert_file = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fcert.pem\"\n  tls_key_file  = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fkey.pem\"\n}\n\nkms \"aead\" {\n  purpose = \"root\"\n  aead_type = \"aes-gcm\"\n  key = \"sP1fnF5Xz85RrXM...\"  # Use Vault Transit in production\n  key_id = \"global_root\"\n}\n\nkms \"aead\" {\n  purpose = \"worker-auth\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_worker-auth\"\n}\n\nkms \"aead\" {\n  purpose = \"recovery\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_recovery\"\n}\n```\n\n### Worker Configuration\n\n```hcl\n# \u002Fetc\u002Fboundary\u002Fworker.hcl\nworker {\n  name = \"boundary-worker-1\"\n  description = \"Worker in production VPC\"\n  public_addr = \"worker1.example.com\"\n\n  controllers = [\n    \"boundary.example.com:9201\"\n  ]\n\n  tags {\n    type = [\"production\"]\n    region = [\"us-east-1\"]\n  }\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9202\"\n  purpose = \"proxy\"\n}\n\nkms \"aead\" {\n  purpose = \"worker-auth\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_worker-auth\"\n}\n```\n\n## Terraform Configuration\n\n### Scope and Auth Configuration\n\n```hcl\n# main.tf - Boundary resources via Terraform\nterraform {\n  required_providers {\n    boundary = {\n      source  = \"hashicorp\u002Fboundary\"\n      version = \"~> 1.1\"\n    }\n  }\n}\n\nprovider \"boundary\" {\n  addr             = \"https:\u002F\u002Fboundary.example.com:9200\"\n  recovery_kms_hcl = file(\"recovery_kms.hcl\")\n}\n\n# Organization scope\nresource \"boundary_scope\" \"org\" {\n  scope_id                 = \"global\"\n  name                     = \"production-org\"\n  description              = \"Production organization scope\"\n  auto_create_admin_role   = true\n  auto_create_default_role = true\n}\n\n# Project scope\nresource \"boundary_scope\" \"production\" {\n  name                     = \"production\"\n  description              = \"Production infrastructure project\"\n  scope_id                 = boundary_scope.org.id\n  auto_create_admin_role   = true\n  auto_create_default_role = true\n}\n\n# OIDC Auth Method (Okta example)\nresource \"boundary_auth_method_oidc\" \"okta\" {\n  scope_id               = boundary_scope.org.id\n  name                   = \"okta\"\n  description            = \"Okta OIDC authentication\"\n  issuer                 = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\n  client_id              = var.okta_client_id\n  client_secret          = var.okta_client_secret\n  signing_algorithms     = [\"RS256\"]\n  api_url_prefix         = \"https:\u002F\u002Fboundary.example.com:9200\"\n  claims_scopes          = [\"groups\"]\n  account_claim_maps     = [\"oid=sub\"]\n  is_primary_for_scope   = true\n}\n\n# Managed group for auto-assignment\nresource \"boundary_managed_group\" \"sre_team\" {\n  auth_method_id = boundary_auth_method_oidc.okta.id\n  name           = \"sre-team\"\n  description    = \"SRE team members from Okta\"\n  filter         = \"\\\"sre-team\\\" in \\\"\u002Ftoken\u002Fgroups\\\"\"\n}\n\nresource \"boundary_managed_group\" \"dev_team\" {\n  auth_method_id = boundary_auth_method_oidc.okta.id\n  name           = \"dev-team\"\n  description    = \"Development team from Okta\"\n  filter         = \"\\\"dev-team\\\" in \\\"\u002Ftoken\u002Fgroups\\\"\"\n}\n```\n\n### Host Catalogs and Targets\n\n```hcl\n# Static host catalog for known infrastructure\nresource \"boundary_host_catalog_static\" \"production_servers\" {\n  name     = \"production-servers\"\n  scope_id = boundary_scope.production.id\n}\n\nresource \"boundary_host_static\" \"web_server\" {\n  name            = \"web-server-1\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  address         = \"10.0.1.10\"\n}\n\nresource \"boundary_host_static\" \"db_server\" {\n  name            = \"db-server-1\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  address         = \"10.0.2.20\"\n}\n\n# Host set grouping\nresource \"boundary_host_set_static\" \"web_servers\" {\n  name            = \"web-servers\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  host_ids        = [boundary_host_static.web_server.id]\n}\n\nresource \"boundary_host_set_static\" \"db_servers\" {\n  name            = \"database-servers\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  host_ids        = [boundary_host_static.db_server.id]\n}\n\n# SSH target\nresource \"boundary_target\" \"ssh_production\" {\n  name         = \"ssh-production-servers\"\n  description  = \"SSH access to production servers\"\n  type         = \"ssh\"\n  scope_id     = boundary_scope.production.id\n  default_port = 22\n\n  host_source_ids = [\n    boundary_host_set_static.web_servers.id\n  ]\n\n  session_max_seconds          = 3600  # 1 hour max session\n  session_connection_limit     = 1\n  enable_session_recording     = true\n  storage_bucket_id            = boundary_storage_bucket.sessions.id\n\n  injected_application_credential_source_ids = [\n    boundary_credential_library_vault_ssh_certificate.ssh_cert.id\n  ]\n}\n\n# Database target with Vault credential brokering\nresource \"boundary_target\" \"postgres_production\" {\n  name         = \"postgres-production\"\n  description  = \"PostgreSQL production database\"\n  type         = \"tcp\"\n  scope_id     = boundary_scope.production.id\n  default_port = 5432\n\n  host_source_ids = [\n    boundary_host_set_static.db_servers.id\n  ]\n\n  session_max_seconds      = 1800  # 30 min max\n  session_connection_limit = 5\n\n  brokered_credential_source_ids = [\n    boundary_credential_library_vault.postgres_creds.id\n  ]\n}\n```\n\n### Vault Integration for Credential Brokering\n\n```hcl\n# Vault credential store\nresource \"boundary_credential_store_vault\" \"vault\" {\n  name        = \"vault-store\"\n  scope_id    = boundary_scope.production.id\n  address     = \"https:\u002F\u002Fvault.example.com:8200\"\n  token       = var.vault_token\n  namespace   = \"production\"\n}\n\n# Dynamic database credentials from Vault\nresource \"boundary_credential_library_vault\" \"postgres_creds\" {\n  name                = \"postgres-dynamic-creds\"\n  credential_store_id = boundary_credential_store_vault.vault.id\n  path                = \"database\u002Fcreds\u002Freadonly\"\n  http_method         = \"GET\"\n  credential_type     = \"username_password\"\n}\n\n# SSH certificate signing via Vault\nresource \"boundary_credential_library_vault_ssh_certificate\" \"ssh_cert\" {\n  name                = \"ssh-certificate\"\n  credential_store_id = boundary_credential_store_vault.vault.id\n  path                = \"ssh-client-signer\u002Fsign\u002Fproduction\"\n  username            = \"admin\"\n  key_type            = \"ed25519\"\n  key_bits            = 256\n  extensions = {\n    \"permit-pty\" = \"\"\n  }\n}\n\n# Session recording storage\nresource \"boundary_storage_bucket\" \"sessions\" {\n  name        = \"session-recordings\"\n  scope_id    = \"global\"\n  plugin_name = \"aws\"\n  bucket_name = \"boundary-session-recordings\"\n  attributes_json = jsonencode({\n    \"region\"                      = \"us-east-1\"\n    \"disable_credential_rotation\" = true\n  })\n  secrets_json = jsonencode({\n    \"access_key_id\"     = var.aws_access_key\n    \"secret_access_key\" = var.aws_secret_key\n  })\n}\n```\n\n### Role-Based Access Control\n\n```hcl\n# SRE team role - full production access\nresource \"boundary_role\" \"sre_production\" {\n  name          = \"sre-production-access\"\n  scope_id      = boundary_scope.production.id\n  grant_strings = [\n    \"ids=*;type=target;actions=list,read,authorize-session\",\n    \"ids=*;type=session;actions=list,read,cancel\",\n    \"ids=*;type=host;actions=list,read\",\n  ]\n  principal_ids = [\n    boundary_managed_group.sre_team.id\n  ]\n}\n\n# Dev team role - limited access\nresource \"boundary_role\" \"dev_staging\" {\n  name          = \"dev-staging-access\"\n  scope_id      = boundary_scope.production.id\n  grant_strings = [\n    \"ids=${boundary_target.ssh_production.id};type=target;actions=read,authorize-session\",\n  ]\n  principal_ids = [\n    boundary_managed_group.dev_team.id\n  ]\n}\n```\n\n## Connecting to Targets\n\n```bash\n# Authenticate via OIDC\nboundary authenticate oidc \\\n  -auth-method-id amoidc_xxxxx\n\n# List available targets\nboundary targets list -scope-id p_xxxxx\n\n# Connect to SSH target (credentials injected by Vault)\nboundary connect ssh \\\n  -target-id ttcp_xxxxx\n\n# Connect to database (credentials brokered by Vault)\nboundary connect postgres \\\n  -target-id ttcp_xxxxx \\\n  -dbname production\n\n# Use Boundary Desktop client for GUI access\n# Download from: https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Finstall\n```\n\n## Session Recording and Auditing\n\n```bash\n# List session recordings\nboundary session-recordings list \\\n  -scope-id p_xxxxx\n\n# Download session recording for review\nboundary session-recordings download \\\n  -id sr_xxxxx \\\n  -output recording.cast\n\n# Play back with asciinema\nasciinema play recording.cast\n```\n\n## Dynamic Host Catalogs\n\n```hcl\n# AWS dynamic host catalog - auto-discovers EC2 instances\nresource \"boundary_host_catalog_plugin\" \"aws_catalog\" {\n  scope_id    = boundary_scope.production.id\n  name        = \"aws-production\"\n  plugin_name = \"aws\"\n\n  attributes_json = jsonencode({\n    \"region\"                      = \"us-east-1\"\n    \"disable_credential_rotation\" = true\n  })\n\n  secrets_json = jsonencode({\n    \"access_key_id\"     = var.aws_access_key\n    \"secret_access_key\" = var.aws_secret_key\n  })\n}\n\nresource \"boundary_host_set_plugin\" \"web_tier\" {\n  host_catalog_id = boundary_host_catalog_plugin.aws_catalog.id\n  name            = \"web-tier\"\n  attributes_json = jsonencode({\n    \"filters\" = [\n      \"tag:Environment=production\",\n      \"tag:Tier=web\"\n    ]\n  })\n}\n```\n\n## Security Best Practices\n\n1. **Use Vault KMS for key management** instead of static AEAD keys in production\n2. **Enable session recording** for all privileged access targets\n3. **Set session time limits** appropriate to the resource sensitivity\n4. **Use OIDC managed groups** for automatic role assignment from IdP\n5. **Deploy multi-hop workers** for accessing resources across network boundaries\n6. **Rotate Vault tokens** used by credential stores regularly\n7. **Enable audit logging** on both controllers and workers\n8. **Use credential injection** (SSH certificates) over brokering when possible\n9. **Implement least-privilege grants** -- avoid wildcard permissions\n10. **Review session recordings** regularly for compliance and incident response\n\n## References\n\n- [HashiCorp Boundary Documentation](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Fdocs)\n- [Boundary and Vault Integration](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Fdocs\u002Fconcepts\u002Fcredential-management)\n- [From Zero to Hero with Boundary](https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fblog\u002Ffrom-zero-to-hero-hashicorp-boundary)\n- [Boundary Terraform Provider](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Fhashicorp\u002Fboundary\u002Flatest\u002Fdocs)\n- [Zero Trust with Vault, Consul, and Boundary](https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fresources\u002Fzero-trust-security-with-hashicorp-vault-consul-and-boundary)\n","# Implementing Zero Trust with HashiCorp Boundary\n\n## Overview\n\nHashiCorp Boundary is an identity-aware proxy that provides secure, zero trust access to infrastructure resources without traditional VPNs or direct network access. Boundary operates on a default-deny model -- users start with no access and must be explicitly granted permissions for specific resources. When integrated with HashiCorp Vault, Boundary can dynamically broker credentials, ensuring users never see or manage underlying secrets. This eliminates credential sprawl and enables just-in-time access with automatic credential revocation when sessions end. Boundary supports session recording for audit compliance, OIDC\u002FLDAP authentication, and manages access through a hierarchical scope model of organizations and projects.\n\n\n## When to Use\n\n- When deploying or configuring implementing zero trust with hashicorp boundary capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- HashiCorp Boundary server (self-hosted or HCP Boundary)\n- HashiCorp Vault (for credential brokering)\n- Identity provider supporting OIDC (Okta, Azure AD, Auth0)\n- PostgreSQL database for Boundary's backend\n- TLS certificates for secure communication\n- Understanding of PKI and X.509 certificate management\n\n## Architecture\n\n```\n                    Identity Provider (OIDC)\n                           |\n                    Authentication\n                           |\n                  +--------+--------+\n                  |   Boundary      |\n                  |   Controller    |\n                  |  (Control Plane)|\n                  +--------+--------+\n                           |\n              +------------+------------+\n              |                         |\n     +--------+--------+      +--------+--------+\n     | Boundary Worker |      | Boundary Worker |\n     | (Data Plane)    |      | (Data Plane)    |\n     +--------+--------+      +--------+--------+\n              |                         |\n     +--------+--------+      +--------+--------+\n     |  Target Hosts   |      |  Target Hosts   |\n     |  (SSH, RDP,     |      |  (Databases,    |\n     |   K8s, HTTP)    |      |   APIs)         |\n     +-----------------+      +-----------------+\n\n     Vault (Credential Brokering)\n     - Dynamic database credentials\n     - SSH certificate signing\n     - Credential libraries\n```\n\n## Installation and Configuration\n\n### Boundary Server Setup\n\n```bash\n# Install Boundary\ncurl -fsSL https:\u002F\u002Fapt.releases.hashicorp.com\u002Fgpg | sudo apt-key add -\nsudo apt-add-repository \"deb [arch=amd64] https:\u002F\u002Fapt.releases.hashicorp.com $(lsb_release -cs) main\"\nsudo apt-get update && sudo apt-get install boundary\n\n# Initialize the database\nboundary database init \\\n  -config=\u002Fetc\u002Fboundary\u002Fcontroller.hcl\n\n# Start the controller\nboundary server -config=\u002Fetc\u002Fboundary\u002Fcontroller.hcl\n```\n\n### Controller Configuration\n\n```hcl\n# \u002Fetc\u002Fboundary\u002Fcontroller.hcl\ncontroller {\n  name = \"boundary-controller-1\"\n  description = \"Primary Boundary Controller\"\n  database {\n    url = \"postgresql:\u002F\u002Fboundary:password@localhost:5432\u002Fboundary?sslmode=require\"\n  }\n  public_cluster_addr = \"boundary.example.com\"\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9200\"\n  purpose = \"api\"\n  tls_cert_file = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fcert.pem\"\n  tls_key_file  = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fkey.pem\"\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9201\"\n  purpose = \"cluster\"\n  tls_cert_file = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fcert.pem\"\n  tls_key_file  = \"\u002Fetc\u002Fboundary\u002Ftls\u002Fkey.pem\"\n}\n\nkms \"aead\" {\n  purpose = \"root\"\n  aead_type = \"aes-gcm\"\n  key = \"sP1fnF5Xz85RrXM...\"  # Use Vault Transit in production\n  key_id = \"global_root\"\n}\n\nkms \"aead\" {\n  purpose = \"worker-auth\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_worker-auth\"\n}\n\nkms \"aead\" {\n  purpose = \"recovery\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_recovery\"\n}\n```\n\n### Worker Configuration\n\n```hcl\n# \u002Fetc\u002Fboundary\u002Fworker.hcl\nworker {\n  name = \"boundary-worker-1\"\n  description = \"Worker in production VPC\"\n  public_addr = \"worker1.example.com\"\n\n  controllers = [\n    \"boundary.example.com:9201\"\n  ]\n\n  tags {\n    type = [\"production\"]\n    region = [\"us-east-1\"]\n  }\n}\n\nlistener \"tcp\" {\n  address = \"0.0.0.0:9202\"\n  purpose = \"proxy\"\n}\n\nkms \"aead\" {\n  purpose = \"worker-auth\"\n  aead_type = \"aes-gcm\"\n  key = \"8fZBjCUfN0TzjEG...\"\n  key_id = \"global_worker-auth\"\n}\n```\n\n## Terraform Configuration\n\n### Scope and Auth Configuration\n\n```hcl\n# main.tf - Boundary resources via Terraform\nterraform {\n  required_providers {\n    boundary = {\n      source  = \"hashicorp\u002Fboundary\"\n      version = \"~> 1.1\"\n    }\n  }\n}\n\nprovider \"boundary\" {\n  addr             = \"https:\u002F\u002Fboundary.example.com:9200\"\n  recovery_kms_hcl = file(\"recovery_kms.hcl\")\n}\n\n# Organization scope\nresource \"boundary_scope\" \"org\" {\n  scope_id                 = \"global\"\n  name                     = \"production-org\"\n  description              = \"Production organization scope\"\n  auto_create_admin_role   = true\n  auto_create_default_role = true\n}\n\n# Project scope\nresource \"boundary_scope\" \"production\" {\n  name                     = \"production\"\n  description              = \"Production infrastructure project\"\n  scope_id                 = boundary_scope.org.id\n  auto_create_admin_role   = true\n  auto_create_default_role = true\n}\n\n# OIDC Auth Method (Okta example)\nresource \"boundary_auth_method_oidc\" \"okta\" {\n  scope_id               = boundary_scope.org.id\n  name                   = \"okta\"\n  description            = \"Okta OIDC authentication\"\n  issuer                 = \"https:\u002F\u002Fcompany.okta.com\u002Foauth2\u002Fdefault\"\n  client_id              = var.okta_client_id\n  client_secret          = var.okta_client_secret\n  signing_algorithms     = [\"RS256\"]\n  api_url_prefix         = \"https:\u002F\u002Fboundary.example.com:9200\"\n  claims_scopes          = [\"groups\"]\n  account_claim_maps     = [\"oid=sub\"]\n  is_primary_for_scope   = true\n}\n\n# Managed group for auto-assignment\nresource \"boundary_managed_group\" \"sre_team\" {\n  auth_method_id = boundary_auth_method_oidc.okta.id\n  name           = \"sre-team\"\n  description    = \"SRE team members from Okta\"\n  filter         = \"\\\"sre-team\\\" in \\\"\u002Ftoken\u002Fgroups\\\"\"\n}\n\nresource \"boundary_managed_group\" \"dev_team\" {\n  auth_method_id = boundary_auth_method_oidc.okta.id\n  name           = \"dev-team\"\n  description    = \"Development team from Okta\"\n  filter         = \"\\\"dev-team\\\" in \\\"\u002Ftoken\u002Fgroups\\\"\"\n}\n```\n\n### Host Catalogs and Targets\n\n```hcl\n# Static host catalog for known infrastructure\nresource \"boundary_host_catalog_static\" \"production_servers\" {\n  name     = \"production-servers\"\n  scope_id = boundary_scope.production.id\n}\n\nresource \"boundary_host_static\" \"web_server\" {\n  name            = \"web-server-1\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  address         = \"10.0.1.10\"\n}\n\nresource \"boundary_host_static\" \"db_server\" {\n  name            = \"db-server-1\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  address         = \"10.0.2.20\"\n}\n\n# Host set grouping\nresource \"boundary_host_set_static\" \"web_servers\" {\n  name            = \"web-servers\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  host_ids        = [boundary_host_static.web_server.id]\n}\n\nresource \"boundary_host_set_static\" \"db_servers\" {\n  name            = \"database-servers\"\n  host_catalog_id = boundary_host_catalog_static.production_servers.id\n  host_ids        = [boundary_host_static.db_server.id]\n}\n\n# SSH target\nresource \"boundary_target\" \"ssh_production\" {\n  name         = \"ssh-production-servers\"\n  description  = \"SSH access to production servers\"\n  type         = \"ssh\"\n  scope_id     = boundary_scope.production.id\n  default_port = 22\n\n  host_source_ids = [\n    boundary_host_set_static.web_servers.id\n  ]\n\n  session_max_seconds          = 3600  # 1 hour max session\n  session_connection_limit     = 1\n  enable_session_recording     = true\n  storage_bucket_id            = boundary_storage_bucket.sessions.id\n\n  injected_application_credential_source_ids = [\n    boundary_credential_library_vault_ssh_certificate.ssh_cert.id\n  ]\n}\n\n# Database target with Vault credential brokering\nresource \"boundary_target\" \"postgres_production\" {\n  name         = \"postgres-production\"\n  description  = \"PostgreSQL production database\"\n  type         = \"tcp\"\n  scope_id     = boundary_scope.production.id\n  default_port = 5432\n\n  host_source_ids = [\n    boundary_host_set_static.db_servers.id\n  ]\n\n  session_max_seconds      = 1800  # 30 min max\n  session_connection_limit = 5\n\n  brokered_credential_source_ids = [\n    boundary_credential_library_vault.postgres_creds.id\n  ]\n}\n```\n\n### Vault Integration for Credential Brokering\n\n```hcl\n# Vault credential store\nresource \"boundary_credential_store_vault\" \"vault\" {\n  name        = \"vault-store\"\n  scope_id    = boundary_scope.production.id\n  address     = \"https:\u002F\u002Fvault.example.com:8200\"\n  token       = var.vault_token\n  namespace   = \"production\"\n}\n\n# Dynamic database credentials from Vault\nresource \"boundary_credential_library_vault\" \"postgres_creds\" {\n  name                = \"postgres-dynamic-creds\"\n  credential_store_id = boundary_credential_store_vault.vault.id\n  path                = \"database\u002Fcreds\u002Freadonly\"\n  http_method         = \"GET\"\n  credential_type     = \"username_password\"\n}\n\n# SSH certificate signing via Vault\nresource \"boundary_credential_library_vault_ssh_certificate\" \"ssh_cert\" {\n  name                = \"ssh-certificate\"\n  credential_store_id = boundary_credential_store_vault.vault.id\n  path                = \"ssh-client-signer\u002Fsign\u002Fproduction\"\n  username            = \"admin\"\n  key_type            = \"ed25519\"\n  key_bits            = 256\n  extensions = {\n    \"permit-pty\" = \"\"\n  }\n}\n\n# Session recording storage\nresource \"boundary_storage_bucket\" \"sessions\" {\n  name        = \"session-recordings\"\n  scope_id    = \"global\"\n  plugin_name = \"aws\"\n  bucket_name = \"boundary-session-recordings\"\n  attributes_json = jsonencode({\n    \"region\"                      = \"us-east-1\"\n    \"disable_credential_rotation\" = true\n  })\n  secrets_json = jsonencode({\n    \"access_key_id\"     = var.aws_access_key\n    \"secret_access_key\" = var.aws_secret_key\n  })\n}\n```\n\n### Role-Based Access Control\n\n```hcl\n# SRE team role - full production access\nresource \"boundary_role\" \"sre_production\" {\n  name          = \"sre-production-access\"\n  scope_id      = boundary_scope.production.id\n  grant_strings = [\n    \"ids=*;type=target;actions=list,read,authorize-session\",\n    \"ids=*;type=session;actions=list,read,cancel\",\n    \"ids=*;type=host;actions=list,read\",\n  ]\n  principal_ids = [\n    boundary_managed_group.sre_team.id\n  ]\n}\n\n# Dev team role - limited access\nresource \"boundary_role\" \"dev_staging\" {\n  name          = \"dev-staging-access\"\n  scope_id      = boundary_scope.production.id\n  grant_strings = [\n    \"ids=${boundary_target.ssh_production.id};type=target;actions=read,authorize-session\",\n  ]\n  principal_ids = [\n    boundary_managed_group.dev_team.id\n  ]\n}\n```\n\n## Connecting to Targets\n\n```bash\n# Authenticate via OIDC\nboundary authenticate oidc \\\n  -auth-method-id amoidc_xxxxx\n\n# List available targets\nboundary targets list -scope-id p_xxxxx\n\n# Connect to SSH target (credentials injected by Vault)\nboundary connect ssh \\\n  -target-id ttcp_xxxxx\n\n# Connect to database (credentials brokered by Vault)\nboundary connect postgres \\\n  -target-id ttcp_xxxxx \\\n  -dbname production\n\n# Use Boundary Desktop client for GUI access\n# Download from: https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Finstall\n```\n\n## Session Recording and Auditing\n\n```bash\n# List session recordings\nboundary session-recordings list \\\n  -scope-id p_xxxxx\n\n# Download session recording for review\nboundary session-recordings download \\\n  -id sr_xxxxx \\\n  -output recording.cast\n\n# Play back with asciinema\nasciinema play recording.cast\n```\n\n## Dynamic Host Catalogs\n\n```hcl\n# AWS dynamic host catalog - auto-discovers EC2 instances\nresource \"boundary_host_catalog_plugin\" \"aws_catalog\" {\n  scope_id    = boundary_scope.production.id\n  name        = \"aws-production\"\n  plugin_name = \"aws\"\n\n  attributes_json = jsonencode({\n    \"region\"                      = \"us-east-1\"\n    \"disable_credential_rotation\" = true\n  })\n\n  secrets_json = jsonencode({\n    \"access_key_id\"     = var.aws_access_key\n    \"secret_access_key\" = var.aws_secret_key\n  })\n}\n\nresource \"boundary_host_set_plugin\" \"web_tier\" {\n  host_catalog_id = boundary_host_catalog_plugin.aws_catalog.id\n  name            = \"web-tier\"\n  attributes_json = jsonencode({\n    \"filters\" = [\n      \"tag:Environment=production\",\n      \"tag:Tier=web\"\n    ]\n  })\n}\n```\n\n## Security Best Practices\n\n1. **Use Vault KMS for key management** instead of static AEAD keys in production\n2. **Enable session recording** for all privileged access targets\n3. **Set session time limits** appropriate to the resource sensitivity\n4. **Use OIDC managed groups** for automatic role assignment from IdP\n5. **Deploy multi-hop workers** for accessing resources across network boundaries\n6. **Rotate Vault tokens** used by credential stores regularly\n7. **Enable audit logging** on both controllers and workers\n8. **Use credential injection** (SSH certificates) over brokering when possible\n9. **Implement least-privilege grants** -- avoid wildcard permissions\n10. **Review session recordings** regularly for compliance and incident response\n\n## References\n\n- [HashiCorp Boundary Documentation](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Fdocs)\n- [Boundary and Vault Integration](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fboundary\u002Fdocs\u002Fconcepts\u002Fcredential-management)\n- [From Zero to Hero with Boundary](https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fblog\u002Ffrom-zero-to-hero-hashicorp-boundary)\n- [Boundary Terraform Provider](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Fhashicorp\u002Fboundary\u002Flatest\u002Fdocs)\n- [Zero Trust with Vault, Consul, and Boundary](https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fresources\u002Fzero-trust-security-with-hashicorp-vault-consul-and-boundary)\n",{"name":5,"tags":44,"author":49,"domain":30,"license":15,"version":50,"mitre_f3":51,"nist_csf":74,"subdomain":79,"description":7,"mitre_attack":80},[31,45,46,24,47,48,22,23],"hashicorp","boundary","vault","identity-aware-proxy","mahipal","1.0",{"tactics":52,"version":55,"techniques":56},[26,53,54],"positioning","resource-development","1.1",[57,61,64,67,70],{"id":58,"name":59,"source":60,"tactic":54},"T1586","Compromise Accounts","attack",{"id":62,"name":63,"source":60,"tactic":26},"T1110","Brute Force",{"id":65,"name":66,"source":60,"tactic":26},"T1110.004","Brute Force:  Credential Stuffing",{"id":68,"name":69,"source":60,"tactic":53},"T1219","Remote Access Tools",{"id":71,"name":72,"source":73,"tactic":26},"F1033","Insider Access Abuse","f3",[75,76,77,78],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[81,82,83,84,62],"T1078","T1190","T1059","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-zero-trust-with-hashicorp-boundary",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":96,"prompt":106,"zipAvailable":107},[97,100,103],{"tool":98,"command":99},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-with-hashicorp-boundary",{"tool":101,"command":102},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-with-hashicorp-boundary",{"tool":104,"command":105},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-zero-trust-with-hashicorp-boundary","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002FSKILL.md",true,[109,115,120,126,130,134,140],{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"assets\u002Ftemplate.md","ASSET","资产文件",1381,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Fassets\u002Ftemplate.md",{"path":116,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002FLICENSE",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fapi-reference.md","REFERENCE","参考文档",1636,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Freferences\u002Fapi-reference.md",{"path":127,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fstandards.md",2275,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Freferences\u002Fstandards.md",{"path":131,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Fworkflows.md",3496,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Freferences\u002Fworkflows.md",{"path":135,"resourceType":136,"resourceTypeDesc":137,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fagent.py","SCRIPT","脚本",6815,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Fscripts\u002Fagent.py",{"path":141,"resourceType":136,"resourceTypeDesc":137,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Fprocess.py",12374,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-zero-trust-with-hashicorp-boundary\u002Fscripts\u002Fprocess.py",[145,174,196,222,248,275],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":156,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[151],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[157,158,159,160,161,30,162,36,35,163,164,165,166,167,168,169,170,171,172,173],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":181,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[180],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},[182,170,183,184,161,185,30,35,186,20,187,27,188,189,190,191,192,193,194,195],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[202,205],{"categoryNo":203,"categoryName":204,"taxonomyType":154,"taxonomyTypeDesc":155},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},[190,207,208,209,210,30,34,211,186,212,213,214,215,216,217,28,218,219,220,221],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[228],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},[230,231,232,30,233,234,235,236,237,238,239,240,241,242,243,244,27,245,246,247],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[254],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},[256,257,258,30,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":276,"name":277,"nameZh":6,"description":278,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":279,"categories":280,"keywords":282,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[281],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},[161,283,30,284,285,286,287,288,289,290,291,28,292,218,293,294,295,296,297,298],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]