[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFH22HR4TAMEQ3KKKHS04Q":3,"skill-same:01M6AFH22HR4TAMEQ3KKKHS04Q":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AFH22HR4TAMEQ3KKKHS04Q","managing-intelligence-lifecycle",null,"Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmanaging-intelligence-lifecycle\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"lifecycle","managing intelligence lifecycle","cybersecurity","threat intelligence","planning","threat-intelligence","cti","NIST-CSF","NIST","PIR","collection","analysis","dissemination","intelligence-lifecycle","NIST-SP-800-150","threat-intelligence-program","2026-11-10 10:12:30",false,"---\nname: managing-intelligence-lifecycle\ndescription: 'Manages the end-to-end cyber threat intelligence lifecycle from planning\n  and direction through collection, processing, analysis, dissemination, and feedback\n  to ensure intelligence products meet stakeholder requirements and continuously improve.\n  Use when establishing or maturing a CTI program, defining intelligence requirements\n  with business stakeholders, or building feedback loops between intelligence consumers\n  and producers. Activates for requests involving CTI program maturity, intelligence\n  requirements, PIRs, or intelligence lifecycle management.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- CTI\n- intelligence-lifecycle\n- PIR\n- NIST-SP-800-150\n- threat-intelligence-program\n- NIST-CSF\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Managing Intelligence Lifecycle\n\n## When to Use\n\nUse this skill when:\n- Establishing a formal CTI program and defining its operational model\n- Conducting quarterly intelligence requirements reviews with business stakeholders\n- Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)\n\n**Do not use** this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.\n\n## Prerequisites\n\n- Executive sponsorship and defined CTI team structure (1+ dedicated analysts)\n- Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)\n- Existing feed subscriptions or ISAC memberships for collection baseline\n- CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management\n\n## Workflow\n\n### Step 1: Planning and Direction\n\nDefine Priority Intelligence Requirements (PIRs) with stakeholders:\n- Interview SOC leads, IR team, CISO, risk management, and product security\n- Document PIRs in structured format: \"What is the current capability and intent of [threat actor] to attack [critical asset] using [technique]?\"\n- Prioritize 5–10 PIRs for the quarter, reviewed monthly\n\nExample PIR: \"Is ransomware group Cl0p currently targeting organizations in our sector using MoveIT or GoAnywhere vulnerabilities?\"\n\n### Step 2: Collection Planning\n\nMap PIRs to required collection sources:\n- Technical sources: commercial feeds, TAXII, ISAC data, honeypot telemetry, darkweb monitoring\n- Human sources: vendor threat briefings, industry working groups, law enforcement partnerships\n- Internal sources: SIEM logs, EDR telemetry, phishing submission mailbox\n\nDocument collection gaps and associated costs to fill them.\n\n### Step 3: Processing and Normalization\n\nImplement automated processing pipeline:\n- Ingest → normalize to STIX 2.1 → deduplicate → enrich → score confidence\n- Reject unverifiable or duplicate indicators before analysis\n- Tag all processed data with source, collection date, and expiration\n\n### Step 4: Analysis and Production\n\nProduce intelligence at three levels:\n- **Strategic**: Quarterly threat landscape report for executives; sector trends, geopolitical context\n- **Operational**: Weekly campaign reports for security leadership; active campaigns, adversary activity\n- **Tactical**: Daily IOC bulletins for SOC; actionable indicators with block\u002Fmonitor recommendations\n\nApply structured analytic techniques: Analysis of Competing Hypotheses (ACH), Key Assumptions Check, Devil's Advocacy.\n\n### Step 5: Dissemination\n\nMatch product format to audience:\n- Executives: 1-page PDF with risk ratings, business impact, recommended decisions\n- SOC analysts: SIEM-ready IOC list, Sigma rules, MISP events\n- Vulnerability management: CVE lists with EPSS scores and exploitation likelihood\n- IT\u002FSecurity leadership: Full intelligence report with technical appendix\n\nApply TLP classifications and distribution lists per product type.\n\n### Step 6: Feedback and Evaluation\n\nCollect feedback within 5 business days of dissemination:\n- Did the product address the PIR?\n- Was actionability sufficient?\n- What data was missing?\n\nTrack metrics quarterly: PIR coverage rate, IOC true positive rate, time-to-disseminate, stakeholder satisfaction score (NPS or structured survey).\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **PIR** | Priority Intelligence Requirement — specific, actionable question driving intelligence collection and analysis |\n| **Intelligence Lifecycle** | Six-phase iterative process: Planning → Collection → Processing → Analysis → Dissemination → Feedback |\n| **Strategic Intelligence** | Long-term threat trend analysis for executive decision-making; time horizon 6–24 months |\n| **Operational Intelligence** | Campaign-level analysis for security program decisions; time horizon 1–6 months |\n| **Tactical Intelligence** | Specific IOCs and TTPs for immediate detection and blocking; time horizon hours to days |\n| **FIRST CTI-SIG** | Forum of Incident Response and Security Teams — CTI Special Interest Group maturity model |\n\n## Tools & Systems\n\n- **ThreatConnect**: TIP with built-in intelligence lifecycle workflows, PIR tracking, and stakeholder reporting dashboards\n- **MISP**: Open-source TIP supporting intelligence lifecycle from collection through sharing\n- **OpenCTI**: Graph-based CTI platform with workflow management for intelligence products\n- **Recorded Future**: Commercial platform with structured intelligence reports aligned to the intelligence lifecycle\n\n## Common Pitfalls\n\n- **Collection without direction**: Ingesting every available feed without PIRs produces data overload and no actionable intelligence.\n- **Missing feedback loops**: Without structured feedback, CTI teams produce reports that don't meet stakeholder needs and lose organizational relevance.\n- **Tactical-only focus**: Overemphasis on IOC sharing neglects strategic intelligence that informs security investment and risk decisions.\n- **No metrics program**: Cannot demonstrate CTI program value without tracking detection contributions, true positive rates, and stakeholder satisfaction.\n- **Underfunded collection**: PIRs cannot be answered without appropriate collection sources; document and escalate gaps rather than producing low-confidence estimates.\n","# Managing Intelligence Lifecycle\n\n## When to Use\n\nUse this skill when:\n- Establishing a formal CTI program and defining its operational model\n- Conducting quarterly intelligence requirements reviews with business stakeholders\n- Evaluating CTI program maturity against established frameworks (FIRST CTI-SIG maturity model)\n\n**Do not use** this skill for day-to-day IOC triage or incident-specific intelligence tasks — those use operational intelligence workflows, not lifecycle management.\n\n## Prerequisites\n\n- Executive sponsorship and defined CTI team structure (1+ dedicated analysts)\n- Stakeholder map identifying intelligence consumers (SOC, IR, executive team, vulnerability management)\n- Existing feed subscriptions or ISAC memberships for collection baseline\n- CTI platform (MISP, ThreatConnect, OpenCTI) for lifecycle management\n\n## Workflow\n\n### Step 1: Planning and Direction\n\nDefine Priority Intelligence Requirements (PIRs) with stakeholders:\n- Interview SOC leads, IR team, CISO, risk management, and product security\n- Document PIRs in structured format: \"What is the current capability and intent of [threat actor] to attack [critical asset] using [technique]?\"\n- Prioritize 5–10 PIRs for the quarter, reviewed monthly\n\nExample PIR: \"Is ransomware group Cl0p currently targeting organizations in our sector using MoveIT or GoAnywhere vulnerabilities?\"\n\n### Step 2: Collection Planning\n\nMap PIRs to required collection sources:\n- Technical sources: commercial feeds, TAXII, ISAC data, honeypot telemetry, darkweb monitoring\n- Human sources: vendor threat briefings, industry working groups, law enforcement partnerships\n- Internal sources: SIEM logs, EDR telemetry, phishing submission mailbox\n\nDocument collection gaps and associated costs to fill them.\n\n### Step 3: Processing and Normalization\n\nImplement automated processing pipeline:\n- Ingest → normalize to STIX 2.1 → deduplicate → enrich → score confidence\n- Reject unverifiable or duplicate indicators before analysis\n- Tag all processed data with source, collection date, and expiration\n\n### Step 4: Analysis and Production\n\nProduce intelligence at three levels:\n- **Strategic**: Quarterly threat landscape report for executives; sector trends, geopolitical context\n- **Operational**: Weekly campaign reports for security leadership; active campaigns, adversary activity\n- **Tactical**: Daily IOC bulletins for SOC; actionable indicators with block\u002Fmonitor recommendations\n\nApply structured analytic techniques: Analysis of Competing Hypotheses (ACH), Key Assumptions Check, Devil's Advocacy.\n\n### Step 5: Dissemination\n\nMatch product format to audience:\n- Executives: 1-page PDF with risk ratings, business impact, recommended decisions\n- SOC analysts: SIEM-ready IOC list, Sigma rules, MISP events\n- Vulnerability management: CVE lists with EPSS scores and exploitation likelihood\n- IT\u002FSecurity leadership: Full intelligence report with technical appendix\n\nApply TLP classifications and distribution lists per product type.\n\n### Step 6: Feedback and Evaluation\n\nCollect feedback within 5 business days of dissemination:\n- Did the product address the PIR?\n- Was actionability sufficient?\n- What data was missing?\n\nTrack metrics quarterly: PIR coverage rate, IOC true positive rate, time-to-disseminate, stakeholder satisfaction score (NPS or structured survey).\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **PIR** | Priority Intelligence Requirement — specific, actionable question driving intelligence collection and analysis |\n| **Intelligence Lifecycle** | Six-phase iterative process: Planning → Collection → Processing → Analysis → Dissemination → Feedback |\n| **Strategic Intelligence** | Long-term threat trend analysis for executive decision-making; time horizon 6–24 months |\n| **Operational Intelligence** | Campaign-level analysis for security program decisions; time horizon 1–6 months |\n| **Tactical Intelligence** | Specific IOCs and TTPs for immediate detection and blocking; time horizon hours to days |\n| **FIRST CTI-SIG** | Forum of Incident Response and Security Teams — CTI Special Interest Group maturity model |\n\n## Tools & Systems\n\n- **ThreatConnect**: TIP with built-in intelligence lifecycle workflows, PIR tracking, and stakeholder reporting dashboards\n- **MISP**: Open-source TIP supporting intelligence lifecycle from collection through sharing\n- **OpenCTI**: Graph-based CTI platform with workflow management for intelligence products\n- **Recorded Future**: Commercial platform with structured intelligence reports aligned to the intelligence lifecycle\n\n## Common Pitfalls\n\n- **Collection without direction**: Ingesting every available feed without PIRs produces data overload and no actionable intelligence.\n- **Missing feedback loops**: Without structured feedback, CTI teams produce reports that don't meet stakeholder needs and lose organizational relevance.\n- **Tactical-only focus**: Overemphasis on IOC sharing neglects strategic intelligence that informs security investment and risk decisions.\n- **No metrics program**: Cannot demonstrate CTI program value without tracking detection contributions, true positive rates, and stakeholder satisfaction.\n- **Underfunded collection**: PIRs cannot be answered without appropriate collection sources; document and escalate gaps rather than producing low-confidence estimates.\n",{"name":5,"tags":45,"author":47,"domain":26,"license":15,"version":48,"nist_csf":49,"subdomain":29,"description":54,"mitre_attack":55},[46,37,33,38,39,31],"CTI","team-cybersecurity","1.0.0",[50,51,52,53],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.\n",[56,57,58,59],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fmanaging-intelligence-lifecycle",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill managing-intelligence-lifecycle",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill managing-intelligence-lifecycle",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill managing-intelligence-lifecycle","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmanaging-intelligence-lifecycle\u002FSKILL.md",true,[84,89,95],{"path":85,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmanaging-intelligence-lifecycle\u002FLICENSE",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fapi-reference.md","REFERENCE","参考文档",2054,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmanaging-intelligence-lifecycle\u002Freferences\u002Fapi-reference.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",7858,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmanaging-intelligence-lifecycle\u002Fscripts\u002Fagent.py",[102,129,153,181,206,232],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,114,26,115,116,117,118,119,120,121,122,123,124,125,126,127,128],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,125,138,139,114,140,26,117,141,142,143,144,145,146,147,148,149,150,151,152],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":163,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[159,162],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,164,165,166,167,26,168,169,141,170,171,172,173,174,175,176,177,178,179,180],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,191,26,192,193,194,195,196,197,198,199,200,201,202,203,144,34,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,26,217,28,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,240,26,241,242,243,244,245,32,246,247,176,248,177,35,249,250,251,252,253],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]