[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFMDQYNS4D9EV7SHHZRW56":3,"skill-same:01M6AFMDQYNS4D9EV7SHHZRW56":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":80,"ownerHtmlUrl":81,"ownerBlogUrl":82,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6AFMDQYNS4D9EV7SHHZRW56","performing-api-security-testing-with-postman",null,"Uses Postman to build structured API security test collections covering the OWASP API Security Top 10—authentication bypass, authorization flaws, injection, and data exposure—with multi-role environments, automated test scripts, and OWASP ZAP\u002FNewman integration for CI\u002FCD. Use when building repeatable Postman-based API security regression tests or automating OWASP API Top 10 coverage in a pipeline.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-security-testing-with-postman\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"security","performing api security testing with postman","testing","pipeline","postman","automated-testing","security-validation","injection","t1059","authorization","owasp","cybersecurity","data","api-security","ci","integration","validation","authentication","pr","test","2026-11-10 10:12:30",false,"---\nname: performing-api-security-testing-with-postman\ndescription: 'Uses Postman to build structured API security test collections covering\n  the OWASP API Security Top 10—authentication bypass, authorization flaws, injection,\n  and data exposure—with multi-role environments, automated test scripts, and OWASP\n  ZAP\u002FNewman integration for CI\u002FCD. Use when building repeatable Postman-based API\n  security regression tests or automating OWASP API Top 10 coverage in a pipeline.\n\n  '\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- postman\n- owasp\n- automated-testing\n- security-validation\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n- T1055\n- T1059\n---\n# Performing API Security Testing with Postman\n\n## When to Use\n\n- Building repeatable API security test suites for OWASP API Security Top 10 coverage\n- Creating automated security regression tests that run in CI\u002FCD pipelines via Newman\n- Testing API authentication and authorization across multiple user roles systematically\n- Integrating Postman with OWASP ZAP proxy for combined manual and automated security testing\n- Establishing a baseline security test collection for new API endpoints before deployment\n\n**Do not use** against production APIs without authorization. Postman security testing involves sending potentially malicious payloads.\n\n## Prerequisites\n\n- Postman Desktop or web application with an active workspace\n- Target API with OpenAPI\u002FSwagger specification for collection import\n- Test accounts for at least three roles: unauthenticated, regular user, admin\n- Newman CLI installed for CI\u002FCD integration: `npm install -g newman`\n- OWASP ZAP configured as local proxy (localhost:8080) for Postman proxy integration\n- API environment variables for base URL, tokens, and test data\n\n## Workflow\n\n### Step 1: Environment and Collection Setup\n\nCreate Postman environments for multi-role testing:\n\n```json\n\u002F\u002F Environment: API Security Test - Regular User\n{\n    \"values\": [\n        {\"key\": \"base_url\", \"value\": \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"},\n        {\"key\": \"auth_token\", \"value\": \"\"},\n        {\"key\": \"user_email\", \"value\": \"regular@test.com\"},\n        {\"key\": \"user_password\", \"value\": \"TestPass123!\"},\n        {\"key\": \"user_id\", \"value\": \"\"},\n        {\"key\": \"other_user_id\", \"value\": \"1002\"},\n        {\"key\": \"admin_endpoint\", \"value\": \"\u002Fadmin\u002Fusers\"},\n        {\"key\": \"test_order_id\", \"value\": \"\"},\n        {\"key\": \"other_user_order_id\", \"value\": \"5003\"}\n    ]\n}\n```\n\n**Pre-request script for automatic authentication:**\n```javascript\n\u002F\u002F Collection-level pre-request script for auto-login\nif (!pm.environment.get(\"auth_token\") || pm.environment.get(\"token_expired\")) {\n    const loginRequest = {\n        url: pm.environment.get(\"base_url\") + \"\u002Fauth\u002Flogin\",\n        method: \"POST\",\n        header: {\"Content-Type\": \"application\u002Fjson\"},\n        body: {\n            mode: \"raw\",\n            raw: JSON.stringify({\n                email: pm.environment.get(\"user_email\"),\n                password: pm.environment.get(\"user_password\")\n            })\n        }\n    };\n\n    pm.sendRequest(loginRequest, (err, res) => {\n        if (!err && res.code === 200) {\n            const token = res.json().access_token;\n            pm.environment.set(\"auth_token\", token);\n            pm.environment.set(\"user_id\", res.json().user.id);\n        }\n    });\n}\n```\n\n### Step 2: BOLA (API1) Test Collection\n\n```javascript\n\u002F\u002F Test: Access other user's profile (BOLA)\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Auth: Bearer {{auth_token}}\n\n\u002F\u002F Test script:\npm.test(\"BOLA: Cannot access other user profile\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\npm.test(\"BOLA: No user data leaked on denial\", function() {\n    if (pm.response.code === 200) {\n        const body = pm.response.json();\n        pm.expect(body).to.not.have.property(\"email\");\n        pm.expect(body).to.not.have.property(\"phone\");\n        pm.expect(body).to.not.have.property(\"address\");\n        \u002F\u002F Flag as BOLA if full profile returned\n        console.error(\"BOLA VULNERABILITY: Full profile returned for other user\");\n    }\n});\n\n\u002F\u002F Test: Access other user's order\n\u002F\u002F Request: GET {{base_url}}\u002Forders\u002F{{other_user_order_id}}\npm.test(\"BOLA: Cannot access other user order\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403, 404]);\n});\n\n\u002F\u002F Test: Modify other user's resource\n\u002F\u002F Request: PATCH {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Body: {\"name\": \"Hacked\"}\npm.test(\"BOLA: Cannot modify other user profile\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n```\n\n### Step 3: Authentication (API2) Test Collection\n\n```javascript\n\u002F\u002F Test: Token validation\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: Bearer invalid_token_value\n\npm.test(\"Auth: Invalid token rejected\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\n\u002F\u002F Test: Expired token handling\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: Bearer {{expired_token}}\n\npm.test(\"Auth: Expired token rejected\", function() {\n    pm.expect(pm.response.code).to.equal(401);\n});\n\n\u002F\u002F Test: Missing authentication\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: None\n\npm.test(\"Auth: Unauthenticated request rejected\", function() {\n    pm.expect(pm.response.code).to.equal(401);\n});\n\n\u002F\u002F Test: SQL injection in login\n\u002F\u002F Request: POST {{base_url}}\u002Fauth\u002Flogin\n\u002F\u002F Body: {\"email\": \"' OR 1=1--\", \"password\": \"test\"}\n\npm.test(\"Auth: SQLi in login rejected\", function() {\n    pm.expect(pm.response.code).to.not.equal(200);\n    pm.expect(pm.response.text()).to.not.include(\"token\");\n});\n\n\u002F\u002F Test: Account enumeration\n\u002F\u002F Pre-request: Send login with valid email + wrong password, then invalid email + wrong password\npm.test(\"Auth: No account enumeration\", function() {\n    \u002F\u002F Compare with stored response from valid email attempt\n    const validEmailResponse = pm.environment.get(\"valid_email_response\");\n    const currentResponse = pm.response.text();\n    pm.expect(currentResponse).to.equal(validEmailResponse);\n});\n```\n\n### Step 4: Data Exposure (API3) and BFLA (API5) Tests\n\n```javascript\n\u002F\u002F Test: Excessive data exposure check\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\npm.test(\"Data Exposure: No sensitive fields in response\", function() {\n    const sensitiveFields = [\n        \"password\", \"password_hash\", \"passwordHash\",\n        \"ssn\", \"social_security\", \"credit_card\",\n        \"api_key\", \"secret_key\", \"mfa_secret\",\n        \"refresh_token\", \"session_id\"\n    ];\n    const responseText = pm.response.text().toLowerCase();\n    sensitiveFields.forEach(field => {\n        pm.expect(responseText).to.not.include('\"' + field + '\"');\n    });\n});\n\npm.test(\"Data Exposure: Security headers present\", function() {\n    pm.expect(pm.response.headers.has(\"X-Content-Type-Options\")).to.be.true;\n    pm.expect(pm.response.headers.has(\"X-Frame-Options\")).to.be.true;\n    pm.expect(pm.response.headers.get(\"X-Content-Type-Options\")).to.equal(\"nosniff\");\n});\n\npm.test(\"Data Exposure: No server info leaked\", function() {\n    pm.expect(pm.response.headers.has(\"Server\")).to.be.false;\n    pm.expect(pm.response.headers.has(\"X-Powered-By\")).to.be.false;\n});\n\n\u002F\u002F Test: BFLA - Admin endpoint access\n\u002F\u002F Request: GET {{base_url}}{{admin_endpoint}}\n\u002F\u002F Auth: Bearer {{auth_token}} (regular user)\n\npm.test(\"BFLA: Regular user cannot access admin endpoint\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\n\u002F\u002F Test: BFLA - Admin function execution\n\u002F\u002F Request: DELETE {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Auth: Bearer {{auth_token}} (regular user)\n\npm.test(\"BFLA: Regular user cannot delete other users\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n```\n\n### Step 5: Mass Assignment and Rate Limiting Tests\n\n```javascript\n\u002F\u002F Test: Mass assignment via profile update\n\u002F\u002F Request: PUT {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Body: {\"name\": \"Test\", \"role\": \"admin\", \"is_admin\": true}\n\npm.test(\"Mass Assignment: Role field not accepted\", function() {\n    if (pm.response.code === 200) {\n        const user = pm.response.json();\n        pm.expect(user.role).to.not.equal(\"admin\");\n        pm.expect(user.is_admin).to.not.equal(true);\n    }\n});\n\n\u002F\u002F Test: Rate limiting enforcement\n\u002F\u002F This test should be run with the Collection Runner at high iteration count\n\npm.test(\"Rate Limiting: Returns 429 when limit exceeded\", function() {\n    \u002F\u002F This test expects to be rate-limited after many iterations\n    const iterationCount = pm.info.iteration;\n    if (iterationCount > 50) {\n        \u002F\u002F After 50 iterations, we should see rate limiting\n        if (pm.response.code === 429) {\n            pm.expect(pm.response.headers.has(\"Retry-After\")).to.be.true;\n            console.log(\"Rate limiting enforced at iteration \" + iterationCount);\n        }\n    }\n});\n\n\u002F\u002F Test: Rate limit headers present\npm.test(\"Rate Limiting: Rate limit headers present\", function() {\n    const hasRateHeaders = pm.response.headers.has(\"X-RateLimit-Limit\") ||\n                           pm.response.headers.has(\"X-Rate-Limit-Limit\") ||\n                           pm.response.headers.has(\"RateLimit-Limit\");\n    pm.expect(hasRateHeaders).to.be.true;\n});\n```\n\n### Step 6: Newman CI\u002FCD Integration\n\n```bash\n# Run security test collection via Newman CLI\nnewman run \"API-Security-Tests.postman_collection.json\" \\\n    --environment \"Security-Test-Environment.postman_environment.json\" \\\n    --reporters cli,htmlextra,junit \\\n    --reporter-htmlextra-export .\u002Freports\u002Fsecurity-test-report.html \\\n    --reporter-junit-export .\u002Freports\u002Fsecurity-test-results.xml \\\n    --iteration-count 1 \\\n    --timeout-request 10000 \\\n    --delay-request 100 \\\n    --bail\n\n# Run with different user roles\nfor role in \"regular_user\" \"admin_user\" \"unauthenticated\"; do\n    echo \"Testing with role: $role\"\n    newman run \"API-Security-Tests.postman_collection.json\" \\\n        --environment \"Security-Test-${role}.postman_environment.json\" \\\n        --reporters cli,junit \\\n        --reporter-junit-export \".\u002Freports\u002Fsecurity-${role}.xml\"\ndone\n```\n\n**GitHub Actions Integration:**\n```yaml\n# .github\u002Fworkflows\u002Fapi-security-test.yml\nname: API Security Tests\non:\n  pull_request:\n    paths: ['src\u002Fapi\u002F**', 'openapi.yaml']\n\njobs:\n  security-test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: actions\u002Fsetup-node@v4\n        with:\n          node-version: '20'\n      - run: npm install -g newman newman-reporter-htmlextra\n      - name: Run API Security Tests\n        run: |\n          newman run tests\u002Fpostman\u002Fapi-security.json \\\n            --environment tests\u002Fpostman\u002Fenv-staging.json \\\n            --reporters cli,htmlextra,junit \\\n            --reporter-htmlextra-export reports\u002Fsecurity.html \\\n            --reporter-junit-export reports\u002Fsecurity.xml\n      - uses: actions\u002Fupload-artifact@v4\n        if: always()\n        with:\n          name: security-reports\n          path: reports\u002F\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Postman Collection** | Organized group of API requests with test scripts that can be shared, version-controlled, and executed automatically |\n| **Newman** | Command-line companion for Postman that enables running collections in CI\u002FCD pipelines and generating test reports |\n| **Pre-request Script** | JavaScript code that executes before a Postman request, used for dynamic authentication and test data setup |\n| **Test Script** | JavaScript code that executes after a Postman response, used to validate security assertions against the response |\n| **Collection Runner** | Postman feature that executes all requests in a collection sequentially with configurable iterations and delays |\n| **Environment Variables** | Key-value pairs scoped to a Postman environment that parameterize requests for different targets, roles, and configurations |\n\n## Tools & Systems\n\n- **Postman**: API platform for building, testing, and documenting APIs with built-in scripting and collection management\n- **Newman**: CLI runner for Postman collections supporting multiple reporters (HTML, JUnit, JSON) for CI\u002FCD integration\n- **OWASP ZAP**: Open-source security proxy that can be configured as Postman's proxy to scan all requests passively\n- **newman-reporter-htmlextra**: Enhanced HTML reporter for Newman that generates detailed test reports with request\u002Fresponse data\n- **Postman Flows**: Visual workflow builder for chaining complex security test sequences with conditional logic\n\n## Common Scenarios\n\n### Scenario: API Security Regression Suite for CI\u002FCD\n\n**Context**: A development team releases API updates bi-weekly. They need an automated security test suite that runs on every pull request to catch authorization and authentication regressions before merge.\n\n**Approach**:\n1. Import the OpenAPI spec into Postman to generate a base collection with all endpoints\n2. Create three environments: unauthenticated, regular user, admin with appropriate credentials\n3. Add security test scripts to each request: BOLA checks, auth validation, data exposure scanning, header security\n4. Create a dedicated \"Security Tests\" folder with injection payloads, mass assignment tests, and rate limit checks\n5. Export the collection and environments to the repository\n6. Configure Newman in GitHub Actions to run on every PR affecting API code\n7. Set the pipeline to fail on any security test failure, blocking the merge\n\n**Pitfalls**:\n- Hardcoding authentication tokens in collections instead of using pre-request scripts for dynamic token generation\n- Not testing with all user roles - only testing authenticated vs unauthenticated misses role-based authorization issues\n- Running security tests against production instead of staging environments\n- Not updating the collection when new endpoints are added, leaving gaps in coverage\n- Ignoring Newman exit codes in CI\u002FCD, allowing failing security tests to pass silently\n\n## Output Format\n\n```\n## API Security Test Report - Postman\u002FNewman\n\n**Collection**: API Security Tests v2.3\n**Environment**: Staging - Regular User\n**Date**: 2024-12-15\n**Total Requests**: 85\n**Total Tests**: 234\n**Passed**: 219\n**Failed**: 15\n\n### Failed Tests Summary\n\n| # | Request | Test Name | Severity |\n|---|---------|-----------|----------|\n| 1 | GET \u002Fusers\u002F1002 | BOLA: Cannot access other user profile | Critical |\n| 2 | GET \u002Forders\u002F5003 | BOLA: Cannot access other user order | Critical |\n| 3 | GET \u002Fadmin\u002Fusers | BFLA: Regular user cannot access admin endpoint | Critical |\n| 4 | PUT \u002Fusers\u002Fme | Mass Assignment: Role field not accepted | High |\n| 5 | GET \u002Fusers\u002Fme | Data Exposure: No sensitive fields in response | High |\n| 6 | POST \u002Fauth\u002Flogin | Auth: No account enumeration | Medium |\n| ... | ... | ... | ... |\n\n### Recommendations\n1. Fix BOLA on \u002Fusers\u002F{id} and \u002Forders\u002F{id} - add object-level authorization checks\n2. Fix BFLA on \u002Fadmin\u002Fusers - enforce role-based access control middleware\n3. Fix mass assignment on PUT \u002Fusers\u002Fme - implement field allowlist\n4. Remove password_hash and mfa_secret from user serialization\n5. Standardize login error messages to prevent account enumeration\n```\n","# Performing API Security Testing with Postman\n\n## When to Use\n\n- Building repeatable API security test suites for OWASP API Security Top 10 coverage\n- Creating automated security regression tests that run in CI\u002FCD pipelines via Newman\n- Testing API authentication and authorization across multiple user roles systematically\n- Integrating Postman with OWASP ZAP proxy for combined manual and automated security testing\n- Establishing a baseline security test collection for new API endpoints before deployment\n\n**Do not use** against production APIs without authorization. Postman security testing involves sending potentially malicious payloads.\n\n## Prerequisites\n\n- Postman Desktop or web application with an active workspace\n- Target API with OpenAPI\u002FSwagger specification for collection import\n- Test accounts for at least three roles: unauthenticated, regular user, admin\n- Newman CLI installed for CI\u002FCD integration: `npm install -g newman`\n- OWASP ZAP configured as local proxy (localhost:8080) for Postman proxy integration\n- API environment variables for base URL, tokens, and test data\n\n## Workflow\n\n### Step 1: Environment and Collection Setup\n\nCreate Postman environments for multi-role testing:\n\n```json\n\u002F\u002F Environment: API Security Test - Regular User\n{\n    \"values\": [\n        {\"key\": \"base_url\", \"value\": \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"},\n        {\"key\": \"auth_token\", \"value\": \"\"},\n        {\"key\": \"user_email\", \"value\": \"regular@test.com\"},\n        {\"key\": \"user_password\", \"value\": \"TestPass123!\"},\n        {\"key\": \"user_id\", \"value\": \"\"},\n        {\"key\": \"other_user_id\", \"value\": \"1002\"},\n        {\"key\": \"admin_endpoint\", \"value\": \"\u002Fadmin\u002Fusers\"},\n        {\"key\": \"test_order_id\", \"value\": \"\"},\n        {\"key\": \"other_user_order_id\", \"value\": \"5003\"}\n    ]\n}\n```\n\n**Pre-request script for automatic authentication:**\n```javascript\n\u002F\u002F Collection-level pre-request script for auto-login\nif (!pm.environment.get(\"auth_token\") || pm.environment.get(\"token_expired\")) {\n    const loginRequest = {\n        url: pm.environment.get(\"base_url\") + \"\u002Fauth\u002Flogin\",\n        method: \"POST\",\n        header: {\"Content-Type\": \"application\u002Fjson\"},\n        body: {\n            mode: \"raw\",\n            raw: JSON.stringify({\n                email: pm.environment.get(\"user_email\"),\n                password: pm.environment.get(\"user_password\")\n            })\n        }\n    };\n\n    pm.sendRequest(loginRequest, (err, res) => {\n        if (!err && res.code === 200) {\n            const token = res.json().access_token;\n            pm.environment.set(\"auth_token\", token);\n            pm.environment.set(\"user_id\", res.json().user.id);\n        }\n    });\n}\n```\n\n### Step 2: BOLA (API1) Test Collection\n\n```javascript\n\u002F\u002F Test: Access other user's profile (BOLA)\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Auth: Bearer {{auth_token}}\n\n\u002F\u002F Test script:\npm.test(\"BOLA: Cannot access other user profile\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\npm.test(\"BOLA: No user data leaked on denial\", function() {\n    if (pm.response.code === 200) {\n        const body = pm.response.json();\n        pm.expect(body).to.not.have.property(\"email\");\n        pm.expect(body).to.not.have.property(\"phone\");\n        pm.expect(body).to.not.have.property(\"address\");\n        \u002F\u002F Flag as BOLA if full profile returned\n        console.error(\"BOLA VULNERABILITY: Full profile returned for other user\");\n    }\n});\n\n\u002F\u002F Test: Access other user's order\n\u002F\u002F Request: GET {{base_url}}\u002Forders\u002F{{other_user_order_id}}\npm.test(\"BOLA: Cannot access other user order\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403, 404]);\n});\n\n\u002F\u002F Test: Modify other user's resource\n\u002F\u002F Request: PATCH {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Body: {\"name\": \"Hacked\"}\npm.test(\"BOLA: Cannot modify other user profile\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n```\n\n### Step 3: Authentication (API2) Test Collection\n\n```javascript\n\u002F\u002F Test: Token validation\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: Bearer invalid_token_value\n\npm.test(\"Auth: Invalid token rejected\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\n\u002F\u002F Test: Expired token handling\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: Bearer {{expired_token}}\n\npm.test(\"Auth: Expired token rejected\", function() {\n    pm.expect(pm.response.code).to.equal(401);\n});\n\n\u002F\u002F Test: Missing authentication\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Auth: None\n\npm.test(\"Auth: Unauthenticated request rejected\", function() {\n    pm.expect(pm.response.code).to.equal(401);\n});\n\n\u002F\u002F Test: SQL injection in login\n\u002F\u002F Request: POST {{base_url}}\u002Fauth\u002Flogin\n\u002F\u002F Body: {\"email\": \"' OR 1=1--\", \"password\": \"test\"}\n\npm.test(\"Auth: SQLi in login rejected\", function() {\n    pm.expect(pm.response.code).to.not.equal(200);\n    pm.expect(pm.response.text()).to.not.include(\"token\");\n});\n\n\u002F\u002F Test: Account enumeration\n\u002F\u002F Pre-request: Send login with valid email + wrong password, then invalid email + wrong password\npm.test(\"Auth: No account enumeration\", function() {\n    \u002F\u002F Compare with stored response from valid email attempt\n    const validEmailResponse = pm.environment.get(\"valid_email_response\");\n    const currentResponse = pm.response.text();\n    pm.expect(currentResponse).to.equal(validEmailResponse);\n});\n```\n\n### Step 4: Data Exposure (API3) and BFLA (API5) Tests\n\n```javascript\n\u002F\u002F Test: Excessive data exposure check\n\u002F\u002F Request: GET {{base_url}}\u002Fusers\u002Fme\n\npm.test(\"Data Exposure: No sensitive fields in response\", function() {\n    const sensitiveFields = [\n        \"password\", \"password_hash\", \"passwordHash\",\n        \"ssn\", \"social_security\", \"credit_card\",\n        \"api_key\", \"secret_key\", \"mfa_secret\",\n        \"refresh_token\", \"session_id\"\n    ];\n    const responseText = pm.response.text().toLowerCase();\n    sensitiveFields.forEach(field => {\n        pm.expect(responseText).to.not.include('\"' + field + '\"');\n    });\n});\n\npm.test(\"Data Exposure: Security headers present\", function() {\n    pm.expect(pm.response.headers.has(\"X-Content-Type-Options\")).to.be.true;\n    pm.expect(pm.response.headers.has(\"X-Frame-Options\")).to.be.true;\n    pm.expect(pm.response.headers.get(\"X-Content-Type-Options\")).to.equal(\"nosniff\");\n});\n\npm.test(\"Data Exposure: No server info leaked\", function() {\n    pm.expect(pm.response.headers.has(\"Server\")).to.be.false;\n    pm.expect(pm.response.headers.has(\"X-Powered-By\")).to.be.false;\n});\n\n\u002F\u002F Test: BFLA - Admin endpoint access\n\u002F\u002F Request: GET {{base_url}}{{admin_endpoint}}\n\u002F\u002F Auth: Bearer {{auth_token}} (regular user)\n\npm.test(\"BFLA: Regular user cannot access admin endpoint\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n\n\u002F\u002F Test: BFLA - Admin function execution\n\u002F\u002F Request: DELETE {{base_url}}\u002Fusers\u002F{{other_user_id}}\n\u002F\u002F Auth: Bearer {{auth_token}} (regular user)\n\npm.test(\"BFLA: Regular user cannot delete other users\", function() {\n    pm.expect(pm.response.code).to.be.oneOf([401, 403]);\n});\n```\n\n### Step 5: Mass Assignment and Rate Limiting Tests\n\n```javascript\n\u002F\u002F Test: Mass assignment via profile update\n\u002F\u002F Request: PUT {{base_url}}\u002Fusers\u002Fme\n\u002F\u002F Body: {\"name\": \"Test\", \"role\": \"admin\", \"is_admin\": true}\n\npm.test(\"Mass Assignment: Role field not accepted\", function() {\n    if (pm.response.code === 200) {\n        const user = pm.response.json();\n        pm.expect(user.role).to.not.equal(\"admin\");\n        pm.expect(user.is_admin).to.not.equal(true);\n    }\n});\n\n\u002F\u002F Test: Rate limiting enforcement\n\u002F\u002F This test should be run with the Collection Runner at high iteration count\n\npm.test(\"Rate Limiting: Returns 429 when limit exceeded\", function() {\n    \u002F\u002F This test expects to be rate-limited after many iterations\n    const iterationCount = pm.info.iteration;\n    if (iterationCount > 50) {\n        \u002F\u002F After 50 iterations, we should see rate limiting\n        if (pm.response.code === 429) {\n            pm.expect(pm.response.headers.has(\"Retry-After\")).to.be.true;\n            console.log(\"Rate limiting enforced at iteration \" + iterationCount);\n        }\n    }\n});\n\n\u002F\u002F Test: Rate limit headers present\npm.test(\"Rate Limiting: Rate limit headers present\", function() {\n    const hasRateHeaders = pm.response.headers.has(\"X-RateLimit-Limit\") ||\n                           pm.response.headers.has(\"X-Rate-Limit-Limit\") ||\n                           pm.response.headers.has(\"RateLimit-Limit\");\n    pm.expect(hasRateHeaders).to.be.true;\n});\n```\n\n### Step 6: Newman CI\u002FCD Integration\n\n```bash\n# Run security test collection via Newman CLI\nnewman run \"API-Security-Tests.postman_collection.json\" \\\n    --environment \"Security-Test-Environment.postman_environment.json\" \\\n    --reporters cli,htmlextra,junit \\\n    --reporter-htmlextra-export .\u002Freports\u002Fsecurity-test-report.html \\\n    --reporter-junit-export .\u002Freports\u002Fsecurity-test-results.xml \\\n    --iteration-count 1 \\\n    --timeout-request 10000 \\\n    --delay-request 100 \\\n    --bail\n\n# Run with different user roles\nfor role in \"regular_user\" \"admin_user\" \"unauthenticated\"; do\n    echo \"Testing with role: $role\"\n    newman run \"API-Security-Tests.postman_collection.json\" \\\n        --environment \"Security-Test-${role}.postman_environment.json\" \\\n        --reporters cli,junit \\\n        --reporter-junit-export \".\u002Freports\u002Fsecurity-${role}.xml\"\ndone\n```\n\n**GitHub Actions Integration:**\n```yaml\n# .github\u002Fworkflows\u002Fapi-security-test.yml\nname: API Security Tests\non:\n  pull_request:\n    paths: ['src\u002Fapi\u002F**', 'openapi.yaml']\n\njobs:\n  security-test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: actions\u002Fsetup-node@v4\n        with:\n          node-version: '20'\n      - run: npm install -g newman newman-reporter-htmlextra\n      - name: Run API Security Tests\n        run: |\n          newman run tests\u002Fpostman\u002Fapi-security.json \\\n            --environment tests\u002Fpostman\u002Fenv-staging.json \\\n            --reporters cli,htmlextra,junit \\\n            --reporter-htmlextra-export reports\u002Fsecurity.html \\\n            --reporter-junit-export reports\u002Fsecurity.xml\n      - uses: actions\u002Fupload-artifact@v4\n        if: always()\n        with:\n          name: security-reports\n          path: reports\u002F\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Postman Collection** | Organized group of API requests with test scripts that can be shared, version-controlled, and executed automatically |\n| **Newman** | Command-line companion for Postman that enables running collections in CI\u002FCD pipelines and generating test reports |\n| **Pre-request Script** | JavaScript code that executes before a Postman request, used for dynamic authentication and test data setup |\n| **Test Script** | JavaScript code that executes after a Postman response, used to validate security assertions against the response |\n| **Collection Runner** | Postman feature that executes all requests in a collection sequentially with configurable iterations and delays |\n| **Environment Variables** | Key-value pairs scoped to a Postman environment that parameterize requests for different targets, roles, and configurations |\n\n## Tools & Systems\n\n- **Postman**: API platform for building, testing, and documenting APIs with built-in scripting and collection management\n- **Newman**: CLI runner for Postman collections supporting multiple reporters (HTML, JUnit, JSON) for CI\u002FCD integration\n- **OWASP ZAP**: Open-source security proxy that can be configured as Postman's proxy to scan all requests passively\n- **newman-reporter-htmlextra**: Enhanced HTML reporter for Newman that generates detailed test reports with request\u002Fresponse data\n- **Postman Flows**: Visual workflow builder for chaining complex security test sequences with conditional logic\n\n## Common Scenarios\n\n### Scenario: API Security Regression Suite for CI\u002FCD\n\n**Context**: A development team releases API updates bi-weekly. They need an automated security test suite that runs on every pull request to catch authorization and authentication regressions before merge.\n\n**Approach**:\n1. Import the OpenAPI spec into Postman to generate a base collection with all endpoints\n2. Create three environments: unauthenticated, regular user, admin with appropriate credentials\n3. Add security test scripts to each request: BOLA checks, auth validation, data exposure scanning, header security\n4. Create a dedicated \"Security Tests\" folder with injection payloads, mass assignment tests, and rate limit checks\n5. Export the collection and environments to the repository\n6. Configure Newman in GitHub Actions to run on every PR affecting API code\n7. Set the pipeline to fail on any security test failure, blocking the merge\n\n**Pitfalls**:\n- Hardcoding authentication tokens in collections instead of using pre-request scripts for dynamic token generation\n- Not testing with all user roles - only testing authenticated vs unauthenticated misses role-based authorization issues\n- Running security tests against production instead of staging environments\n- Not updating the collection when new endpoints are added, leaving gaps in coverage\n- Ignoring Newman exit codes in CI\u002FCD, allowing failing security tests to pass silently\n\n## Output Format\n\n```\n## API Security Test Report - Postman\u002FNewman\n\n**Collection**: API Security Tests v2.3\n**Environment**: Staging - Regular User\n**Date**: 2024-12-15\n**Total Requests**: 85\n**Total Tests**: 234\n**Passed**: 219\n**Failed**: 15\n\n### Failed Tests Summary\n\n| # | Request | Test Name | Severity |\n|---|---------|-----------|----------|\n| 1 | GET \u002Fusers\u002F1002 | BOLA: Cannot access other user profile | Critical |\n| 2 | GET \u002Forders\u002F5003 | BOLA: Cannot access other user order | Critical |\n| 3 | GET \u002Fadmin\u002Fusers | BFLA: Regular user cannot access admin endpoint | Critical |\n| 4 | PUT \u002Fusers\u002Fme | Mass Assignment: Role field not accepted | High |\n| 5 | GET \u002Fusers\u002Fme | Data Exposure: No sensitive fields in response | High |\n| 6 | POST \u002Fauth\u002Flogin | Auth: No account enumeration | Medium |\n| ... | ... | ... | ... |\n\n### Recommendations\n1. Fix BOLA on \u002Fusers\u002F{id} and \u002Forders\u002F{id} - add object-level authorization checks\n2. Fix BFLA on \u002Fadmin\u002Fusers - enforce role-based access control middleware\n3. Fix mass assignment on PUT \u002Fusers\u002Fme - implement field allowlist\n4. Remove password_hash and mfa_secret from user serialization\n5. Standardize login error messages to prevent account enumeration\n```\n",{"name":5,"tags":60,"author":61,"domain":46,"license":15,"version":62,"nist_csf":63,"subdomain":48,"description":68,"mitre_attack":69},[48,39,45,40,41],"mahipal","1.0.0",[64,65,66,67],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","Uses Postman to build structured API security test collections covering the OWASP API Security Top 10—authentication bypass, authorization flaws, injection, and data exposure—with multi-role environments, automated test scripts, and OWASP ZAP\u002FNewman integration for CI\u002FCD. Use when building repeatable Postman-based API security regression tests or automating OWASP API Top 10 coverage in a pipeline.\n",[70,71,72,73,74],"T1190","T1059.007","T1552.001","T1055","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-api-security-testing-with-postman",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-security-testing-with-postman",{"tool":91,"command":92},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-security-testing-with-postman",{"tool":94,"command":95},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-security-testing-with-postman","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-security-testing-with-postman\u002FSKILL.md",true,[99,104,110],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-security-testing-with-postman\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",2119,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-security-testing-with-postman\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",9039,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-security-testing-with-postman\u002Fscripts\u002Fagent.py",[117,140,164,188,213,240],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":124,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[123],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[125,126,127,128,35,46,129,130,53,131,132,49,133,38,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","supply-chain","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[148,136,149,150,35,151,46,53,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":172,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[158,173,174,175,37,46,176,51,152,177,178,179,180,181,182,183,184,185,186,187],"backup","recovery","validating backup integrity for recovery","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[194],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,198,46,199,200,201,202,203,204,205,47,206,207,208,209,155,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,46,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[35,248,46,249,250,251,252,253,254,255,256,183,257,184,258,259,260,261,262,263],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]