[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFKKA7P3DA9369S3SS5R9Z":3,"skill-same:01M6AFKKA7P3DA9369S3SS5R9Z":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AFKKA7P3DA9369S3SS5R9Z","performing-agentless-vulnerability-scanning",null,"Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing agentless vulnerability scanning","vulnerability scanning","t1078","tenable","vuls","snapshot-analysis","ssh","vulnerability-assessment","agentless-scanning","analysis","wmi","security","endpoint","vulnerability-management","network","cloud-security","cloud","protocols","assessment","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-agentless-vulnerability-scanning\ndescription: Configure and execute agentless vulnerability scanning using network\n  protocols, cloud snapshot analysis, and API-based discovery to assess systems without\n  installing endpoint agents.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- agentless-scanning\n- vulnerability-assessment\n- cloud-security\n- ssh\n- wmi\n- snapshot-analysis\n- vuls\n- tenable\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n- T1078.004\n- T1530\n---\n# Performing Agentless Vulnerability Scanning\n\n## Overview\nAgentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux\u002FFreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing agentless vulnerability scanning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- SSH key-based authentication configured on Linux\u002FUnix targets\n- WMI\u002FWinRM access on Windows targets with appropriate credentials\n- Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)\n- Network access from scanner to target systems on required ports\n- Service account with read-only access to target system configurations\n- Python 3.8+ for custom scanning automation\n\n## Core Concepts\n\n### Agentless vs Agent-Based Scanning\n\n| Aspect | Agentless | Agent-Based |\n|--------|-----------|-------------|\n| Deployment | No software installation needed | Agent install on every endpoint |\n| Network dependency | Requires network connectivity | Works offline with cloud sync |\n| Performance impact | Minimal on target systems | Light continuous overhead |\n| Coverage depth | Depends on protocol\u002Fcredentials | Deep local access |\n| Cloud snapshot analysis | Native capability | Not applicable |\n| Ideal for | Cloud VMs, IoT, legacy systems, OT | Managed endpoints, laptops |\n\n### Agentless Scanning Methods\n\n| Method | Protocol | Target OS | Port | Use Case |\n|--------|----------|-----------|------|----------|\n| SSH Remote Commands | SSH | Linux\u002FUnix | 22 | Package enumeration, config audit |\n| WMI Remote Query | WMI\u002FDCOM | Windows | 135, 445 | Hotfix enumeration, registry checks |\n| WinRM PowerShell | WS-Man | Windows | 5985\u002F5986 | Remote command execution |\n| SNMP Community | SNMP v2c\u002Fv3 | Network devices | 161 | Device fingerprinting, firmware check |\n| Cloud Snapshot | Provider API | Cloud VMs | N\u002FA | Disk image analysis |\n| Container Registry | HTTPS | Container images | 443 | Image vulnerability scanning |\n| API-Based | REST\u002FHTTPS | SaaS\u002FCloud | 443 | Configuration assessment |\n\n### Cloud Snapshot Analysis Flow\n```\n1. Scanner requests disk snapshot via cloud API\n2. Cloud provider creates snapshot of VM root + data disks\n3. Scanner mounts snapshot in isolated analysis environment\n4. Scanner examines OS packages, configurations, file system\n5. Snapshot is deleted after analysis (no persistent copies)\n6. Results sent to central management console\n```\n\n## Workflow\n\n### Step 1: SSH-Based Agentless Scanning (Linux)\n\n```bash\n# Create dedicated scan SSH key pair\nssh-keygen -t ed25519 -f \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -N \"\" \\\n  -C \"vuln-scanner@security.local\"\n\n# Deploy public key to targets via Ansible\n# ansible-playbook deploy_scan_key.yml\n\n# Test connectivity to target\nssh -i \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -o ConnectTimeout=10 \\\n  scanner@target-host \"cat \u002Fetc\u002Fos-release && dpkg -l 2>\u002Fdev\u002Fnull || rpm -qa\"\n```\n\n```python\nimport paramiko\nimport json\n\nclass AgentlessLinuxScanner:\n    \"\"\"SSH-based agentless vulnerability scanner for Linux systems.\"\"\"\n\n    def __init__(self, key_path):\n        self.key_path = key_path\n\n    def connect(self, hostname, username=\"scanner\", port=22):\n        \"\"\"Establish SSH connection to target.\"\"\"\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)\n        client.connect(hostname, port=port, username=username, pkey=key,\n                       timeout=30, banner_timeout=30)\n        return client\n\n    def get_os_info(self, client):\n        \"\"\"Detect OS type and version.\"\"\"\n        _, stdout, _ = client.exec_command(\"cat \u002Fetc\u002Fos-release\", timeout=10)\n        os_release = stdout.read().decode()\n        info = {}\n        for line in os_release.strip().split(\"\\n\"):\n            if \"=\" in line:\n                key, val = line.split(\"=\", 1)\n                info[key] = val.strip('\"')\n        return info\n\n    def get_installed_packages(self, client):\n        \"\"\"Enumerate installed packages.\"\"\"\n        # Try dpkg (Debian\u002FUbuntu)\n        _, stdout, _ = client.exec_command(\n            \"dpkg-query -W -f='${Package}|${Version}|${Architecture}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        if output:\n            packages = []\n            for line in output.split(\"\\n\"):\n                parts = line.split(\"|\")\n                if len(parts) >= 2:\n                    packages.append({\n                        \"name\": parts[0],\n                        \"version\": parts[1],\n                        \"arch\": parts[2] if len(parts) > 2 else \"\",\n                        \"manager\": \"dpkg\"\n                    })\n            return packages\n\n        # Try rpm (RHEL\u002FCentOS\u002FFedora)\n        _, stdout, _ = client.exec_command(\n            \"rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        packages = []\n        for line in output.split(\"\\n\"):\n            parts = line.split(\"|\")\n            if len(parts) >= 2:\n                packages.append({\n                    \"name\": parts[0],\n                    \"version\": parts[1],\n                    \"arch\": parts[2] if len(parts) > 2 else \"\",\n                    \"manager\": \"rpm\"\n                })\n        return packages\n\n    def check_kernel_version(self, client):\n        \"\"\"Get running kernel version.\"\"\"\n        _, stdout, _ = client.exec_command(\"uname -r\", timeout=10)\n        return stdout.read().decode().strip()\n\n    def check_listening_ports(self, client):\n        \"\"\"Enumerate listening network services.\"\"\"\n        _, stdout, _ = client.exec_command(\n            \"ss -tlnp 2>\u002Fdev\u002Fnull || netstat -tlnp 2>\u002Fdev\u002Fnull\",\n            timeout=10\n        )\n        return stdout.read().decode().strip()\n\n    def scan_host(self, hostname, username=\"scanner\"):\n        \"\"\"Perform full agentless scan of a host.\"\"\"\n        print(f\"[*] Scanning {hostname}...\")\n        client = self.connect(hostname, username)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(client),\n            \"kernel\": self.check_kernel_version(client),\n            \"packages\": self.get_installed_packages(client),\n            \"listening_ports\": self.check_listening_ports(client),\n        }\n\n        client.close()\n        print(f\"  [+] Found {len(result['packages'])} packages on {hostname}\")\n        return result\n```\n\n### Step 2: WinRM-Based Agentless Scanning (Windows)\n\n```python\nimport winrm\n\nclass AgentlessWindowsScanner:\n    \"\"\"WinRM-based agentless vulnerability scanner for Windows.\"\"\"\n\n    def __init__(self, username, password, domain=None):\n        self.username = username\n        self.password = password\n        self.domain = domain\n\n    def connect(self, hostname, use_ssl=True):\n        \"\"\"Create WinRM session.\"\"\"\n        port = 5986 if use_ssl else 5985\n        transport = \"ntlm\"\n        user = f\"{self.domain}\\\\{self.username}\" if self.domain else self.username\n        session = winrm.Session(\n            f\"{'https' if use_ssl else 'http'}:\u002F\u002F{hostname}:{port}\u002Fwsman\",\n            auth=(user, self.password),\n            transport=transport,\n            server_cert_validation=\"ignore\"\n        )\n        return session\n\n    def get_installed_hotfixes(self, session):\n        \"\"\"Get installed Windows updates\u002Fhotfixes.\"\"\"\n        cmd = \"Get-HotFix | Select-Object HotFixID,InstalledOn,Description | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_installed_software(self, session):\n        \"\"\"Enumerate installed software from registry.\"\"\"\n        cmd = \"\"\"\n        $paths = @(\n            'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',\n            'HKLM:\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'\n        )\n        Get-ItemProperty $paths -ErrorAction SilentlyContinue |\n            Where-Object {$_.DisplayName} |\n            Select-Object DisplayName, DisplayVersion, Publisher |\n            ConvertTo-Json\n        \"\"\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_os_info(self, session):\n        \"\"\"Get Windows OS details.\"\"\"\n        cmd = \"Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return {}\n\n    def scan_host(self, hostname):\n        \"\"\"Perform full agentless scan of Windows host.\"\"\"\n        print(f\"[*] Scanning {hostname} via WinRM...\")\n        session = self.connect(hostname)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(session),\n            \"hotfixes\": self.get_installed_hotfixes(session),\n            \"software\": self.get_installed_software(session),\n        }\n\n        print(f\"  [+] Found {len(result['hotfixes'])} hotfixes, \"\n              f\"{len(result['software'])} software entries\")\n        return result\n```\n\n### Step 3: Cloud Snapshot Scanning (AWS)\n\n```python\nimport boto3\nimport time\n\nclass AWSSnapshotScanner:\n    \"\"\"AWS EC2 agentless snapshot-based vulnerability scanner.\"\"\"\n\n    def __init__(self, region=\"us-east-1\"):\n        self.ec2 = boto3.client(\"ec2\", region_name=region)\n\n    def create_snapshot(self, volume_id, description=\"Security scan snapshot\"):\n        \"\"\"Create EBS snapshot for analysis.\"\"\"\n        snapshot = self.ec2.create_snapshot(\n            VolumeId=volume_id,\n            Description=description,\n            TagSpecifications=[{\n                \"ResourceType\": \"snapshot\",\n                \"Tags\": [\n                    {\"Key\": \"Purpose\", \"Value\": \"VulnScan\"},\n                    {\"Key\": \"AutoDelete\", \"Value\": \"true\"},\n                ]\n            }]\n        )\n        snapshot_id = snapshot[\"SnapshotId\"]\n        print(f\"  [*] Creating snapshot {snapshot_id} from {volume_id}...\")\n\n        waiter = self.ec2.get_waiter(\"snapshot_completed\")\n        waiter.wait(SnapshotIds=[snapshot_id])\n        print(f\"  [+] Snapshot {snapshot_id} ready\")\n        return snapshot_id\n\n    def delete_snapshot(self, snapshot_id):\n        \"\"\"Clean up snapshot after analysis.\"\"\"\n        self.ec2.delete_snapshot(SnapshotId=snapshot_id)\n        print(f\"  [+] Deleted snapshot {snapshot_id}\")\n\n    def scan_instance(self, instance_id):\n        \"\"\"Scan an EC2 instance via snapshot analysis.\"\"\"\n        print(f\"[*] Agentless scan of instance {instance_id}\")\n\n        instance = self.ec2.describe_instances(\n            InstanceIds=[instance_id]\n        )[\"Reservations\"][0][\"Instances\"][0]\n\n        root_volume = None\n        for bdm in instance.get(\"BlockDeviceMappings\", []):\n            if bdm[\"DeviceName\"] == instance.get(\"RootDeviceName\"):\n                root_volume = bdm[\"Ebs\"][\"VolumeId\"]\n                break\n\n        if not root_volume:\n            print(\"  [!] No root volume found\")\n            return None\n\n        snapshot_id = self.create_snapshot(root_volume)\n        try:\n            # Analysis would be performed here\n            # Mount snapshot, examine packages, check configs\n            result = {\n                \"instance_id\": instance_id,\n                \"snapshot_id\": snapshot_id,\n                \"root_volume\": root_volume,\n                \"platform\": instance.get(\"Platform\", \"linux\"),\n                \"state\": instance[\"State\"][\"Name\"],\n            }\n            return result\n        finally:\n            self.delete_snapshot(snapshot_id)\n```\n\n### Step 4: Vuls Open-Source Agentless Scanner\n\n```toml\n# \u002Fetc\u002Fvuls\u002Fconfig.toml - Vuls configuration for agentless scanning\n\n[servers]\n\n[servers.web-server-01]\nhost = \"192.168.1.10\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\n\n[servers.db-server-01]\nhost = \"192.168.1.20\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast-root\"]\n[servers.db-server-01.optional]\n  [servers.db-server-01.optional.sudo]\n    password = \"\"\n\n[servers.container-host-01]\nhost = \"192.168.1.30\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\ncontainersIncluded = [\"${running}\"]\n```\n\n```bash\n# Run Vuls agentless scan\nvuls scan\n\n# Generate report\nvuls report -format-json -to-localfile\n\n# View results\nvuls tui\n```\n\n## Best Practices\n1. Use SSH key-based authentication instead of passwords for Linux scanning\n2. Create dedicated service accounts with minimal read-only privileges for scanning\n3. Always clean up cloud snapshots after analysis to avoid storage costs and data exposure\n4. Combine agentless scanning with agent-based for comprehensive coverage\n5. Schedule scans during low-activity periods to minimize any performance impact\n6. Rotate scanning credentials regularly and store in a secrets vault\n7. Test scanner connectivity before scheduling production scans\n8. Use SNMPv3 with authentication and encryption for network device scanning\n\n## Common Pitfalls\n- Using shared credentials across multiple environments without proper segmentation\n- Not cleaning up temporary snapshots in cloud environments\n- Assuming agentless scanning has zero performance impact (network and CPU are used)\n- Missing WinRM\u002FSSH firewall rules causing scan failures on new deployments\n- Not accounting for SSH host key changes causing authentication failures\n- Scanning OT\u002FICS devices with protocols they cannot safely handle\n\n## Related Skills\n- implementing-rapid7-insightvm-for-scanning\n- implementing-wazuh-for-vulnerability-detection\n- deploying-osquery-for-endpoint-monitoring\n- performing-remediation-validation-scanning\n","# Performing Agentless Vulnerability Scanning\n\n## Overview\nAgentless vulnerability scanning assesses systems for security weaknesses without requiring endpoint agent installation. This approach leverages existing network protocols (SSH for Linux, WMI for Windows), cloud provider APIs for snapshot-based analysis, and authenticated remote checks. Modern cloud platforms like Microsoft Defender for Cloud, Wiz, Datadog, and Tenable perform out-of-band analysis by taking disk snapshots and examining OS configurations and installed packages offline. The open-source tool Vuls provides agentless scanning based on NVD and OVAL data for Linux\u002FFreeBSD systems. This skill covers configuring agentless scans across on-premises, cloud, and containerized environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing agentless vulnerability scanning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- SSH key-based authentication configured on Linux\u002FUnix targets\n- WMI\u002FWinRM access on Windows targets with appropriate credentials\n- Cloud provider API credentials (AWS IAM, Azure RBAC, GCP IAM)\n- Network access from scanner to target systems on required ports\n- Service account with read-only access to target system configurations\n- Python 3.8+ for custom scanning automation\n\n## Core Concepts\n\n### Agentless vs Agent-Based Scanning\n\n| Aspect | Agentless | Agent-Based |\n|--------|-----------|-------------|\n| Deployment | No software installation needed | Agent install on every endpoint |\n| Network dependency | Requires network connectivity | Works offline with cloud sync |\n| Performance impact | Minimal on target systems | Light continuous overhead |\n| Coverage depth | Depends on protocol\u002Fcredentials | Deep local access |\n| Cloud snapshot analysis | Native capability | Not applicable |\n| Ideal for | Cloud VMs, IoT, legacy systems, OT | Managed endpoints, laptops |\n\n### Agentless Scanning Methods\n\n| Method | Protocol | Target OS | Port | Use Case |\n|--------|----------|-----------|------|----------|\n| SSH Remote Commands | SSH | Linux\u002FUnix | 22 | Package enumeration, config audit |\n| WMI Remote Query | WMI\u002FDCOM | Windows | 135, 445 | Hotfix enumeration, registry checks |\n| WinRM PowerShell | WS-Man | Windows | 5985\u002F5986 | Remote command execution |\n| SNMP Community | SNMP v2c\u002Fv3 | Network devices | 161 | Device fingerprinting, firmware check |\n| Cloud Snapshot | Provider API | Cloud VMs | N\u002FA | Disk image analysis |\n| Container Registry | HTTPS | Container images | 443 | Image vulnerability scanning |\n| API-Based | REST\u002FHTTPS | SaaS\u002FCloud | 443 | Configuration assessment |\n\n### Cloud Snapshot Analysis Flow\n```\n1. Scanner requests disk snapshot via cloud API\n2. Cloud provider creates snapshot of VM root + data disks\n3. Scanner mounts snapshot in isolated analysis environment\n4. Scanner examines OS packages, configurations, file system\n5. Snapshot is deleted after analysis (no persistent copies)\n6. Results sent to central management console\n```\n\n## Workflow\n\n### Step 1: SSH-Based Agentless Scanning (Linux)\n\n```bash\n# Create dedicated scan SSH key pair\nssh-keygen -t ed25519 -f \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -N \"\" \\\n  -C \"vuln-scanner@security.local\"\n\n# Deploy public key to targets via Ansible\n# ansible-playbook deploy_scan_key.yml\n\n# Test connectivity to target\nssh -i \u002Fopt\u002Fscanner\u002F.ssh\u002Fscan_key -o ConnectTimeout=10 \\\n  scanner@target-host \"cat \u002Fetc\u002Fos-release && dpkg -l 2>\u002Fdev\u002Fnull || rpm -qa\"\n```\n\n```python\nimport paramiko\nimport json\n\nclass AgentlessLinuxScanner:\n    \"\"\"SSH-based agentless vulnerability scanner for Linux systems.\"\"\"\n\n    def __init__(self, key_path):\n        self.key_path = key_path\n\n    def connect(self, hostname, username=\"scanner\", port=22):\n        \"\"\"Establish SSH connection to target.\"\"\"\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)\n        client.connect(hostname, port=port, username=username, pkey=key,\n                       timeout=30, banner_timeout=30)\n        return client\n\n    def get_os_info(self, client):\n        \"\"\"Detect OS type and version.\"\"\"\n        _, stdout, _ = client.exec_command(\"cat \u002Fetc\u002Fos-release\", timeout=10)\n        os_release = stdout.read().decode()\n        info = {}\n        for line in os_release.strip().split(\"\\n\"):\n            if \"=\" in line:\n                key, val = line.split(\"=\", 1)\n                info[key] = val.strip('\"')\n        return info\n\n    def get_installed_packages(self, client):\n        \"\"\"Enumerate installed packages.\"\"\"\n        # Try dpkg (Debian\u002FUbuntu)\n        _, stdout, _ = client.exec_command(\n            \"dpkg-query -W -f='${Package}|${Version}|${Architecture}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        if output:\n            packages = []\n            for line in output.split(\"\\n\"):\n                parts = line.split(\"|\")\n                if len(parts) >= 2:\n                    packages.append({\n                        \"name\": parts[0],\n                        \"version\": parts[1],\n                        \"arch\": parts[2] if len(parts) > 2 else \"\",\n                        \"manager\": \"dpkg\"\n                    })\n            return packages\n\n        # Try rpm (RHEL\u002FCentOS\u002FFedora)\n        _, stdout, _ = client.exec_command(\n            \"rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\\\n'\",\n            timeout=30\n        )\n        output = stdout.read().decode().strip()\n        packages = []\n        for line in output.split(\"\\n\"):\n            parts = line.split(\"|\")\n            if len(parts) >= 2:\n                packages.append({\n                    \"name\": parts[0],\n                    \"version\": parts[1],\n                    \"arch\": parts[2] if len(parts) > 2 else \"\",\n                    \"manager\": \"rpm\"\n                })\n        return packages\n\n    def check_kernel_version(self, client):\n        \"\"\"Get running kernel version.\"\"\"\n        _, stdout, _ = client.exec_command(\"uname -r\", timeout=10)\n        return stdout.read().decode().strip()\n\n    def check_listening_ports(self, client):\n        \"\"\"Enumerate listening network services.\"\"\"\n        _, stdout, _ = client.exec_command(\n            \"ss -tlnp 2>\u002Fdev\u002Fnull || netstat -tlnp 2>\u002Fdev\u002Fnull\",\n            timeout=10\n        )\n        return stdout.read().decode().strip()\n\n    def scan_host(self, hostname, username=\"scanner\"):\n        \"\"\"Perform full agentless scan of a host.\"\"\"\n        print(f\"[*] Scanning {hostname}...\")\n        client = self.connect(hostname, username)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(client),\n            \"kernel\": self.check_kernel_version(client),\n            \"packages\": self.get_installed_packages(client),\n            \"listening_ports\": self.check_listening_ports(client),\n        }\n\n        client.close()\n        print(f\"  [+] Found {len(result['packages'])} packages on {hostname}\")\n        return result\n```\n\n### Step 2: WinRM-Based Agentless Scanning (Windows)\n\n```python\nimport winrm\n\nclass AgentlessWindowsScanner:\n    \"\"\"WinRM-based agentless vulnerability scanner for Windows.\"\"\"\n\n    def __init__(self, username, password, domain=None):\n        self.username = username\n        self.password = password\n        self.domain = domain\n\n    def connect(self, hostname, use_ssl=True):\n        \"\"\"Create WinRM session.\"\"\"\n        port = 5986 if use_ssl else 5985\n        transport = \"ntlm\"\n        user = f\"{self.domain}\\\\{self.username}\" if self.domain else self.username\n        session = winrm.Session(\n            f\"{'https' if use_ssl else 'http'}:\u002F\u002F{hostname}:{port}\u002Fwsman\",\n            auth=(user, self.password),\n            transport=transport,\n            server_cert_validation=\"ignore\"\n        )\n        return session\n\n    def get_installed_hotfixes(self, session):\n        \"\"\"Get installed Windows updates\u002Fhotfixes.\"\"\"\n        cmd = \"Get-HotFix | Select-Object HotFixID,InstalledOn,Description | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_installed_software(self, session):\n        \"\"\"Enumerate installed software from registry.\"\"\"\n        cmd = \"\"\"\n        $paths = @(\n            'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',\n            'HKLM:\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'\n        )\n        Get-ItemProperty $paths -ErrorAction SilentlyContinue |\n            Where-Object {$_.DisplayName} |\n            Select-Object DisplayName, DisplayVersion, Publisher |\n            ConvertTo-Json\n        \"\"\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return []\n\n    def get_os_info(self, session):\n        \"\"\"Get Windows OS details.\"\"\"\n        cmd = \"Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture | ConvertTo-Json\"\n        result = session.run_ps(cmd)\n        if result.status_code == 0:\n            return json.loads(result.std_out.decode())\n        return {}\n\n    def scan_host(self, hostname):\n        \"\"\"Perform full agentless scan of Windows host.\"\"\"\n        print(f\"[*] Scanning {hostname} via WinRM...\")\n        session = self.connect(hostname)\n\n        result = {\n            \"hostname\": hostname,\n            \"os_info\": self.get_os_info(session),\n            \"hotfixes\": self.get_installed_hotfixes(session),\n            \"software\": self.get_installed_software(session),\n        }\n\n        print(f\"  [+] Found {len(result['hotfixes'])} hotfixes, \"\n              f\"{len(result['software'])} software entries\")\n        return result\n```\n\n### Step 3: Cloud Snapshot Scanning (AWS)\n\n```python\nimport boto3\nimport time\n\nclass AWSSnapshotScanner:\n    \"\"\"AWS EC2 agentless snapshot-based vulnerability scanner.\"\"\"\n\n    def __init__(self, region=\"us-east-1\"):\n        self.ec2 = boto3.client(\"ec2\", region_name=region)\n\n    def create_snapshot(self, volume_id, description=\"Security scan snapshot\"):\n        \"\"\"Create EBS snapshot for analysis.\"\"\"\n        snapshot = self.ec2.create_snapshot(\n            VolumeId=volume_id,\n            Description=description,\n            TagSpecifications=[{\n                \"ResourceType\": \"snapshot\",\n                \"Tags\": [\n                    {\"Key\": \"Purpose\", \"Value\": \"VulnScan\"},\n                    {\"Key\": \"AutoDelete\", \"Value\": \"true\"},\n                ]\n            }]\n        )\n        snapshot_id = snapshot[\"SnapshotId\"]\n        print(f\"  [*] Creating snapshot {snapshot_id} from {volume_id}...\")\n\n        waiter = self.ec2.get_waiter(\"snapshot_completed\")\n        waiter.wait(SnapshotIds=[snapshot_id])\n        print(f\"  [+] Snapshot {snapshot_id} ready\")\n        return snapshot_id\n\n    def delete_snapshot(self, snapshot_id):\n        \"\"\"Clean up snapshot after analysis.\"\"\"\n        self.ec2.delete_snapshot(SnapshotId=snapshot_id)\n        print(f\"  [+] Deleted snapshot {snapshot_id}\")\n\n    def scan_instance(self, instance_id):\n        \"\"\"Scan an EC2 instance via snapshot analysis.\"\"\"\n        print(f\"[*] Agentless scan of instance {instance_id}\")\n\n        instance = self.ec2.describe_instances(\n            InstanceIds=[instance_id]\n        )[\"Reservations\"][0][\"Instances\"][0]\n\n        root_volume = None\n        for bdm in instance.get(\"BlockDeviceMappings\", []):\n            if bdm[\"DeviceName\"] == instance.get(\"RootDeviceName\"):\n                root_volume = bdm[\"Ebs\"][\"VolumeId\"]\n                break\n\n        if not root_volume:\n            print(\"  [!] No root volume found\")\n            return None\n\n        snapshot_id = self.create_snapshot(root_volume)\n        try:\n            # Analysis would be performed here\n            # Mount snapshot, examine packages, check configs\n            result = {\n                \"instance_id\": instance_id,\n                \"snapshot_id\": snapshot_id,\n                \"root_volume\": root_volume,\n                \"platform\": instance.get(\"Platform\", \"linux\"),\n                \"state\": instance[\"State\"][\"Name\"],\n            }\n            return result\n        finally:\n            self.delete_snapshot(snapshot_id)\n```\n\n### Step 4: Vuls Open-Source Agentless Scanner\n\n```toml\n# \u002Fetc\u002Fvuls\u002Fconfig.toml - Vuls configuration for agentless scanning\n\n[servers]\n\n[servers.web-server-01]\nhost = \"192.168.1.10\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\n\n[servers.db-server-01]\nhost = \"192.168.1.20\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast-root\"]\n[servers.db-server-01.optional]\n  [servers.db-server-01.optional.sudo]\n    password = \"\"\n\n[servers.container-host-01]\nhost = \"192.168.1.30\"\nport = \"22\"\nuser = \"vuls\"\nkeyPath = \"\u002Fopt\u002Fvuls\u002F.ssh\u002Fscan_key\"\nscanMode = [\"fast\"]\ncontainersIncluded = [\"${running}\"]\n```\n\n```bash\n# Run Vuls agentless scan\nvuls scan\n\n# Generate report\nvuls report -format-json -to-localfile\n\n# View results\nvuls tui\n```\n\n## Best Practices\n1. Use SSH key-based authentication instead of passwords for Linux scanning\n2. Create dedicated service accounts with minimal read-only privileges for scanning\n3. Always clean up cloud snapshots after analysis to avoid storage costs and data exposure\n4. Combine agentless scanning with agent-based for comprehensive coverage\n5. Schedule scans during low-activity periods to minimize any performance impact\n6. Rotate scanning credentials regularly and store in a secrets vault\n7. Test scanner connectivity before scheduling production scans\n8. Use SNMPv3 with authentication and encryption for network device scanning\n\n## Common Pitfalls\n- Using shared credentials across multiple environments without proper segmentation\n- Not cleaning up temporary snapshots in cloud environments\n- Assuming agentless scanning has zero performance impact (network and CPU are used)\n- Missing WinRM\u002FSSH firewall rules causing scan failures on new deployments\n- Not accounting for SSH host key changes causing authentication failures\n- Scanning OT\u002FICS devices with protocols they cannot safely handle\n\n## Related Skills\n- implementing-rapid7-insightvm-for-scanning\n- implementing-wazuh-for-vulnerability-detection\n- deploying-osquery-for-endpoint-monitoring\n- performing-remediation-validation-scanning\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":37,"description":7,"nist_ai_rmf":57,"mitre_attack":61},[32,31,39,30,34,29,28,27],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[58,59,60],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1",[62,63,64,65,66],"T1190","T1203","T1068","T1078.004","T1530","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-agentless-vulnerability-scanning",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-agentless-vulnerability-scanning",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-agentless-vulnerability-scanning",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-agentless-vulnerability-scanning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002FSKILL.md",true,[91,97,102,108,112,116,122],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Ftemplate.md","ASSET","资产文件",993,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Fassets\u002Ftemplate.md",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",3050,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",1260,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",2664,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",6754,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",7739,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-agentless-vulnerability-scanning\u002Fscripts\u002Fprocess.py",[127,153,177,204,230,256],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,136,137,138,35,43,139,140,141,142,143,144,145,146,147,148,149,150,151,152],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,149,162,163,35,164,43,141,165,166,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[171,188,189,190,191,43,192,193,165,194,195,196,197,198,199,26,200,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,43,215,216,217,218,219,220,221,222,223,224,225,226,168,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,43,241,242,243,37,244,245,246,247,248,249,250,251,252,253,254,255],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[262],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,264,43,265,266,267,268,269,270,271,272,26,273,200,33,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]