[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFKVCHTSS373JP4XPP47HV":3,"skill-same:01M6AFKVCHTSS373JP4XPP47HV":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":72,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":76,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6AFKVCHTSS373JP4XPP47HV","performing-alert-triage-with-elastic-siem",null,"Perform systematic alert triage in Elastic Security SIEM—classifying, prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security detections, prioritizing an analyst's alert queue, or investigating alerts during SOC operations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"elastic","performing alert triage with elastic siem","alert triage","siem","triage","detection","cybersecurity","kibana","esql","elastic-security","alert-triage","analysis","t1566","t1078","security","data","soc","protocol","authentication","workflows","2026-11-10 10:12:30",false,"---\nname: performing-alert-triage-with-elastic-siem\ndescription: Perform systematic alert triage in Elastic Security SIEM—classifying,\n  prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized\n  data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security\n  detections, prioritizing an analyst's alert queue, or investigating alerts during\n  SOC operations.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- elastic\n- siem\n- alert-triage\n- soc\n- elastic-security\n- detection\n- esql\n- kibana\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Restore Access\n- Application Protocol Command Analysis\n- Password Authentication\n- Reissue Credential\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n\n# Performing Alert Triage with Elastic SIEM\n\n## Overview\n\nAlert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing alert triage with elastic siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Elastic Security deployed (version 8.x or later)\n- Elastic Agent or Beats configured for endpoint and network data collection\n- Detection rules enabled and generating alerts\n- Elastic Common Schema (ECS) compliance across data sources\n- Analyst access to Kibana Security app with appropriate privileges\n\n## Alert Triage Workflow\n\n### Step 1: Initial Alert Assessment (2 minutes)\n\nWhen viewing an alert in Elastic Security, review the alert details panel:\n\n```\nAlert Details Panel:\n- Rule Name and Description\n- Severity and Risk Score\n- MITRE ATT&CK Mapping\n- Host and User Context\n- Process Tree (for endpoint alerts)\n- Timeline of related events\n```\n\n#### Key Fields to Examine First\n\n| Field | Purpose | ECS Field |\n|---|---|---|\n| Rule severity | Initial priority assessment | `kibana.alert.severity` |\n| Risk score | Quantified threat level | `kibana.alert.risk_score` |\n| Host name | Affected system | `host.name` |\n| User name | Affected identity | `user.name` |\n| Process name | Executing process | `process.name` |\n| Source IP | Origin of activity | `source.ip` |\n| Destination IP | Target of activity | `destination.ip` |\n| MITRE tactic | Attack stage | `threat.tactic.name` |\n\n### Step 2: Context Gathering (3 minutes)\n\n#### Query Related Events with ES|QL\n\n```esql\nFROM logs-endpoint.events.*\n| WHERE host.name == \"affected-host\" AND @timestamp > NOW() - 1 HOUR\n| STATS count = COUNT(*) BY event.category, event.action\n| SORT count DESC\n```\n\n#### Find All Activity from Suspicious User\n\n```esql\nFROM logs-*\n| WHERE user.name == \"suspicious-user\" AND @timestamp > NOW() - 24 HOURS\n| STATS count = COUNT(*), unique_hosts = COUNT_DISTINCT(host.name) BY event.category\n| SORT count DESC\n```\n\n#### Check for Related Alerts from Same Source\n\n```esql\nFROM .alerts-security.alerts-default\n| WHERE source.ip == \"10.0.0.50\" AND @timestamp > NOW() - 24 HOURS\n| STATS alert_count = COUNT(*) BY kibana.alert.rule.name, kibana.alert.severity\n| SORT alert_count DESC\n```\n\n#### Investigate Lateral Movement from Same IP\n\n```esql\nFROM logs-system.auth-*\n| WHERE source.ip == \"10.0.0.50\" AND event.outcome == \"success\"\n| STATS login_count = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY user.name\n| WHERE hosts > 3\n```\n\n### Step 3: Threat Intelligence Enrichment (2 minutes)\n\nCheck indicators against threat intelligence:\n\n```esql\nFROM logs-ti_*\n| WHERE threat.indicator.ip == \"203.0.113.50\"\n| KEEP threat.indicator.type, threat.indicator.provider, threat.indicator.confidence, threat.feed.name\n```\n\n#### Check File Hash Against Known Threats\n\n```esql\nFROM logs-endpoint.events.file-*\n| WHERE file.hash.sha256 == \"abc123...\"\n| STATS occurrences = COUNT(*) BY host.name, file.path, user.name\n```\n\n### Step 4: Classification Decision (2 minutes)\n\n| Classification | Criteria | Action |\n|---|---|---|\n| True Positive | Confirmed malicious activity | Escalate to incident, begin containment |\n| Benign True Positive | Expected behavior matching rule | Document in alert notes, acknowledge |\n| False Positive | Rule triggered on benign activity | Mark as false positive, create tuning task |\n| Needs Investigation | Insufficient data for determination | Assign for deeper investigation |\n\n### Step 5: Documentation and Escalation (1 minute)\n\nFor each triaged alert, document:\n- Classification decision with rationale\n- Evidence artifacts examined\n- Related alerts or investigations\n- Recommended next steps\n\n## Detection Rules for Triage\n\n### Pre-Built Detection Rules\n\nElastic Security includes 1000+ pre-built detection rules organized by:\n- **MITRE ATT&CK Tactic**: Initial Access, Execution, Persistence, etc.\n- **Platform**: Windows, Linux, macOS, Cloud\n- **Data Source**: Endpoint, Network, Cloud, Identity\n\n### Custom Alert Correlation Rule\n\n```json\n{\n  \"name\": \"Multiple Failed Logins Followed by Success\",\n  \"type\": \"threshold\",\n  \"query\": \"event.category:authentication AND event.outcome:failure\",\n  \"threshold\": {\n    \"field\": [\"source.ip\", \"user.name\"],\n    \"value\": 5,\n    \"cardinality\": [\n      {\n        \"field\": \"user.name\",\n        \"value\": 3\n      }\n    ]\n  },\n  \"severity\": \"high\",\n  \"risk_score\": 73,\n  \"threat\": [\n    {\n      \"framework\": \"MITRE ATT&CK\",\n      \"tactic\": {\n        \"id\": \"TA0006\",\n        \"name\": \"Credential Access\"\n      },\n      \"technique\": [\n        {\n          \"id\": \"T1110\",\n          \"name\": \"Brute Force\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## AI-Assisted Triage\n\n### Elastic AI Assistant Integration\n\n1. Open alert in Elastic Security\n2. Click AI Assistant panel\n3. Use quick prompts:\n   - \"Summarize this alert\" - Get initial assessment\n   - \"Generate ES|QL query to find related activity\" - Expand investigation\n   - \"What are the recommended response actions?\" - Get playbook guidance\n   - \"Is this likely a false positive?\" - Get AI confidence assessment\n\n### Attack Discovery\n\nElastic's Attack Discovery automatically:\n- Groups related alerts into attack chains\n- Maps alerts to MITRE ATT&CK kill chain stages\n- Filters false positives using ML models\n- Prioritizes based on business impact\n- Provides narrative summary of the attack\n\n## Triage Prioritization Matrix\n\n| Risk Score | Severity | Asset Criticality | Response SLA |\n|---|---|---|---|\n| 90-100 | Critical | High | 15 minutes |\n| 70-89 | High | High | 30 minutes |\n| 70-89 | High | Medium | 1 hour |\n| 50-69 | Medium | Any | 4 hours |\n| 21-49 | Low | Any | 8 hours |\n| 1-20 | Informational | Any | 24 hours |\n\n## Triage Metrics and KPIs\n\n| Metric | Target | Measurement |\n|---|---|---|\n| Mean Time to Triage (MTTT) | \u003C 10 minutes | Time from alert creation to classification |\n| False Positive Rate | \u003C 30% | False positives \u002F total alerts |\n| Escalation Rate | 10-20% | Escalated alerts \u002F total alerts |\n| Alert Coverage | > 80% | Triaged alerts \u002F generated alerts per shift |\n| Reclassification Rate | \u003C 5% | Changed classifications \u002F total classified |\n\n## References\n\n- [Elastic Security - Triage Alerts Documentation](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fsecurity\u002Fai\u002Ftriage-alerts)\n- [SOC Analyst's Guide to Triage with Elastic](https:\u002F\u002Fsystemweakness.com\u002Ffrom-alert-to-action-a-soc-analysts-guide-to-triage-with-elastic-%EF%B8%8F-4e5354ab5da9)\n- [Elastic Blog - AI and 2025 SIEM Landscape](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Fai-siem-landscape)\n- [Reducing False Positives with Elastic and Tines](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Ffalse-positives-automated-siem-investigations-elastic-tines)\n","# Performing Alert Triage with Elastic SIEM\n\n## Overview\n\nAlert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing alert triage with elastic siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Elastic Security deployed (version 8.x or later)\n- Elastic Agent or Beats configured for endpoint and network data collection\n- Detection rules enabled and generating alerts\n- Elastic Common Schema (ECS) compliance across data sources\n- Analyst access to Kibana Security app with appropriate privileges\n\n## Alert Triage Workflow\n\n### Step 1: Initial Alert Assessment (2 minutes)\n\nWhen viewing an alert in Elastic Security, review the alert details panel:\n\n```\nAlert Details Panel:\n- Rule Name and Description\n- Severity and Risk Score\n- MITRE ATT&CK Mapping\n- Host and User Context\n- Process Tree (for endpoint alerts)\n- Timeline of related events\n```\n\n#### Key Fields to Examine First\n\n| Field | Purpose | ECS Field |\n|---|---|---|\n| Rule severity | Initial priority assessment | `kibana.alert.severity` |\n| Risk score | Quantified threat level | `kibana.alert.risk_score` |\n| Host name | Affected system | `host.name` |\n| User name | Affected identity | `user.name` |\n| Process name | Executing process | `process.name` |\n| Source IP | Origin of activity | `source.ip` |\n| Destination IP | Target of activity | `destination.ip` |\n| MITRE tactic | Attack stage | `threat.tactic.name` |\n\n### Step 2: Context Gathering (3 minutes)\n\n#### Query Related Events with ES|QL\n\n```esql\nFROM logs-endpoint.events.*\n| WHERE host.name == \"affected-host\" AND @timestamp > NOW() - 1 HOUR\n| STATS count = COUNT(*) BY event.category, event.action\n| SORT count DESC\n```\n\n#### Find All Activity from Suspicious User\n\n```esql\nFROM logs-*\n| WHERE user.name == \"suspicious-user\" AND @timestamp > NOW() - 24 HOURS\n| STATS count = COUNT(*), unique_hosts = COUNT_DISTINCT(host.name) BY event.category\n| SORT count DESC\n```\n\n#### Check for Related Alerts from Same Source\n\n```esql\nFROM .alerts-security.alerts-default\n| WHERE source.ip == \"10.0.0.50\" AND @timestamp > NOW() - 24 HOURS\n| STATS alert_count = COUNT(*) BY kibana.alert.rule.name, kibana.alert.severity\n| SORT alert_count DESC\n```\n\n#### Investigate Lateral Movement from Same IP\n\n```esql\nFROM logs-system.auth-*\n| WHERE source.ip == \"10.0.0.50\" AND event.outcome == \"success\"\n| STATS login_count = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY user.name\n| WHERE hosts > 3\n```\n\n### Step 3: Threat Intelligence Enrichment (2 minutes)\n\nCheck indicators against threat intelligence:\n\n```esql\nFROM logs-ti_*\n| WHERE threat.indicator.ip == \"203.0.113.50\"\n| KEEP threat.indicator.type, threat.indicator.provider, threat.indicator.confidence, threat.feed.name\n```\n\n#### Check File Hash Against Known Threats\n\n```esql\nFROM logs-endpoint.events.file-*\n| WHERE file.hash.sha256 == \"abc123...\"\n| STATS occurrences = COUNT(*) BY host.name, file.path, user.name\n```\n\n### Step 4: Classification Decision (2 minutes)\n\n| Classification | Criteria | Action |\n|---|---|---|\n| True Positive | Confirmed malicious activity | Escalate to incident, begin containment |\n| Benign True Positive | Expected behavior matching rule | Document in alert notes, acknowledge |\n| False Positive | Rule triggered on benign activity | Mark as false positive, create tuning task |\n| Needs Investigation | Insufficient data for determination | Assign for deeper investigation |\n\n### Step 5: Documentation and Escalation (1 minute)\n\nFor each triaged alert, document:\n- Classification decision with rationale\n- Evidence artifacts examined\n- Related alerts or investigations\n- Recommended next steps\n\n## Detection Rules for Triage\n\n### Pre-Built Detection Rules\n\nElastic Security includes 1000+ pre-built detection rules organized by:\n- **MITRE ATT&CK Tactic**: Initial Access, Execution, Persistence, etc.\n- **Platform**: Windows, Linux, macOS, Cloud\n- **Data Source**: Endpoint, Network, Cloud, Identity\n\n### Custom Alert Correlation Rule\n\n```json\n{\n  \"name\": \"Multiple Failed Logins Followed by Success\",\n  \"type\": \"threshold\",\n  \"query\": \"event.category:authentication AND event.outcome:failure\",\n  \"threshold\": {\n    \"field\": [\"source.ip\", \"user.name\"],\n    \"value\": 5,\n    \"cardinality\": [\n      {\n        \"field\": \"user.name\",\n        \"value\": 3\n      }\n    ]\n  },\n  \"severity\": \"high\",\n  \"risk_score\": 73,\n  \"threat\": [\n    {\n      \"framework\": \"MITRE ATT&CK\",\n      \"tactic\": {\n        \"id\": \"TA0006\",\n        \"name\": \"Credential Access\"\n      },\n      \"technique\": [\n        {\n          \"id\": \"T1110\",\n          \"name\": \"Brute Force\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## AI-Assisted Triage\n\n### Elastic AI Assistant Integration\n\n1. Open alert in Elastic Security\n2. Click AI Assistant panel\n3. Use quick prompts:\n   - \"Summarize this alert\" - Get initial assessment\n   - \"Generate ES|QL query to find related activity\" - Expand investigation\n   - \"What are the recommended response actions?\" - Get playbook guidance\n   - \"Is this likely a false positive?\" - Get AI confidence assessment\n\n### Attack Discovery\n\nElastic's Attack Discovery automatically:\n- Groups related alerts into attack chains\n- Maps alerts to MITRE ATT&CK kill chain stages\n- Filters false positives using ML models\n- Prioritizes based on business impact\n- Provides narrative summary of the attack\n\n## Triage Prioritization Matrix\n\n| Risk Score | Severity | Asset Criticality | Response SLA |\n|---|---|---|---|\n| 90-100 | Critical | High | 15 minutes |\n| 70-89 | High | High | 30 minutes |\n| 70-89 | High | Medium | 1 hour |\n| 50-69 | Medium | Any | 4 hours |\n| 21-49 | Low | Any | 8 hours |\n| 1-20 | Informational | Any | 24 hours |\n\n## Triage Metrics and KPIs\n\n| Metric | Target | Measurement |\n|---|---|---|\n| Mean Time to Triage (MTTT) | \u003C 10 minutes | Time from alert creation to classification |\n| False Positive Rate | \u003C 30% | False positives \u002F total alerts |\n| Escalation Rate | 10-20% | Escalated alerts \u002F total alerts |\n| Alert Coverage | > 80% | Triaged alerts \u002F generated alerts per shift |\n| Reclassification Rate | \u003C 5% | Changed classifications \u002F total classified |\n\n## References\n\n- [Elastic Security - Triage Alerts Documentation](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fsecurity\u002Fai\u002Ftriage-alerts)\n- [SOC Analyst's Guide to Triage with Elastic](https:\u002F\u002Fsystemweakness.com\u002Ffrom-alert-to-action-a-soc-analysts-guide-to-triage-with-elastic-%EF%B8%8F-4e5354ab5da9)\n- [Elastic Blog - AI and 2025 SIEM Landscape](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Fai-siem-landscape)\n- [Reducing False Positives with Elastic and Tines](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Ffalse-positives-automated-siem-investigations-elastic-tines)\n",{"name":5,"tags":49,"author":50,"domain":30,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58,"d3fend_techniques":63},[24,27,34,40,33,29,32,31],"mahipal","1.0",[53,54,55,56],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[59,60,61,62],"T1078","T1685.002","T1685.005","T1566",[64,65,66,67,68],"Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Reissue Credential","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-alert-triage-with-elastic-siem",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem",{"tool":85,"command":86},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem",{"tool":88,"command":89},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-alert-triage-with-elastic-siem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002FSKILL.md",true,[93,99,104,110,114,118,124],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"assets\u002Ftemplate.md","ASSET","资产文件",1203,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Fassets\u002Ftemplate.md",{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",2847,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",1699,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",1618,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",6797,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fprocess.py",11465,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-alert-triage-with-elastic-siem\u002Fscripts\u002Fprocess.py",[129,155,179,205,230,257],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,138,139,140,38,30,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,38,166,30,143,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,30,194,195,167,196,197,198,199,200,29,37,201,202,203,204],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,30,216,217,218,219,220,221,222,39,223,224,225,226,170,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,30,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[263],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[38,265,30,27,266,267,40,268,269,270,271,37,272,201,35,273,274,275,276,277],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]