[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFS5WT8KM4Z2E8T118EAQS":3,"skill-same:01M6AFS5WT8KM4Z2E8T118EAQS":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":88,"commitSha":89,"skillDirectory":90,"forksCount":91,"repositoryHtmlUrl":92,"repositoryHomepageUrl":93,"ownerHtmlUrl":94,"ownerBlogUrl":95,"ownerDescription":96,"updatedAt":97,"install":98,"resources":111},"01M6AFS5WT8KM4Z2E8T118EAQS","performing-entitlement-review-with-sailpoint-iiq",null,"Runs entitlement review and access certification campaigns in SailPoint IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based access validation, segregation-of-duties violation remediation, and automated revocation workflows. Use when performing periodic user access recertification, auditing SailPoint IIQ access governance, or investigating SOD violations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-entitlement-review-with-sailpoint-iiq\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing entitlement review with sailpoint iiq","sailpoint","review","defense","access-governance","entitlement-certification","IdentityIQ","access-review","t1098","initial-access","t1078","remediation","IGA","certifications","development","pr","governance","identity","workflows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-entitlement-review-with-sailpoint-iiq\ndescription: 'Runs entitlement review and access certification campaigns in SailPoint\n  IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based\n  access validation, segregation-of-duties violation remediation, and automated\n  revocation workflows. Use when performing periodic user access recertification,\n  auditing SailPoint IIQ access governance, or investigating SOD violations.'\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- SailPoint\n- IdentityIQ\n- access-review\n- entitlement-certification\n- IGA\n- access-governance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - defense-impairment\n  - resource-development\n  techniques:\n  - id: T1586\n    name: Compromise Accounts\n    tactic: resource-development\n    source: attack\n  - id: F1033\n    name: Insider Access Abuse\n    tactic: initial-access\n    source: f3\n  - id: F1005\n    name: Account Manipulation\n    tactic: positioning\n    source: f3\n  - id: F1005.002\n    name: 'Account Manipulation: Add Authorized User'\n    tactic: positioning\n    source: f3\n  - id: F1005.007\n    name: 'Account Manipulation: Enable Account Features'\n    tactic: defense-impairment\n    source: f3\n---\n\n# Performing Entitlement Review with SailPoint IdentityIQ\n\n## When to Use\n\n- Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS)\n- Organization needs automated manager-based access reviews for all direct reports\n- Targeted entitlement reviews are needed for sensitive applications or high-privilege roles\n- Separation of Duties (SOD) violations must be identified and remediated\n- Orphaned accounts and excessive entitlements need to be discovered and cleaned up\n- Audit findings require evidence of periodic access review and remediation tracking\n\n**Do not use** for real-time access control decisions; IdentityIQ certifications are periodic review processes designed for governance and compliance validation.\n\n## Prerequisites\n\n- SailPoint IdentityIQ 8.2+ deployed with database backend (Oracle, MySQL, or SQL Server)\n- Application connectors configured for all in-scope systems (Active Directory, LDAP, databases, SaaS applications)\n- Identity cubes aggregated with current entitlement data from all connected sources\n- Email server configured for certification notifications\n- Manager hierarchy defined in the identity model\n- Business roles and entitlement glossary populated for reviewer context\n\n## Workflow\n\n### Step 1: Define Certification Campaign Strategy\n\nPlan the certification scope and reviewer assignments:\n\n```java\n\u002F\u002F SailPoint IdentityIQ BeanShell - Campaign Configuration\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport java.util.*;\n\n\u002F\u002F Define campaign schedule for quarterly manager certifications\nCertificationSchedule schedule = new CertificationSchedule();\nschedule.setName(\"Q1-2026-Manager-Access-Review\");\nschedule.setDescription(\"Quarterly manager certification for all active employees\");\nschedule.setType(Certification.Type.Manager);\n\n\u002F\u002F Configure campaign scope\nCertificationDefinition certDef = new CertificationDefinition();\ncertDef.setName(\"Q1 Manager Certification\");\ncertDef.setOwner(context.getObjectByName(Identity.class, \"cert-admin\"));\n\n\u002F\u002F Set certification options\ncertDef.setCertifierSelectionType(CertificationDefinition.CertifierSelectionType.Manager);\ncertDef.setIncludeEntitlements(true);\ncertDef.setIncludeRoles(true);\ncertDef.setIncludeAccounts(true);\ncertDef.setIncludeAdditionalEntitlements(true);\n\n\u002F\u002F Exclude service accounts from manager reviews\nFilter exclusionFilter = Filter.ne(\"type\", \"service\");\ncertDef.setExclusionFilter(exclusionFilter);\n\n\u002F\u002F Configure notification settings\ncertDef.setNotificationEnabled(true);\ncertDef.setReminderFrequency(7); \u002F\u002F days\ncertDef.setEscalationEnabled(true);\ncertDef.setEscalationDays(14);\ncertDef.setEscalationRecipient(\"security-governance-team\");\n\n\u002F\u002F Set active period\ncertDef.setActivePeriodDays(30);\ncertDef.setAutoCloseEnabled(true);\ncertDef.setDefaultRevoke(true); \u002F\u002F Revoke if not reviewed\n\ncontext.saveObject(certDef);\ncontext.commitTransaction();\n```\n\n### Step 2: Configure Targeted Entitlement Certification\n\nSet up focused reviews for high-risk applications and privileged entitlements:\n\n```java\n\u002F\u002F Targeted certification for privileged access review\nimport sailpoint.object.*;\nimport sailpoint.api.*;\n\nCertificationDefinition targetedCert = new CertificationDefinition();\ntargetedCert.setName(\"Privileged Access Targeted Review\");\ntargetedCert.setType(Certification.Type.ApplicationOwner);\n\n\u002F\u002F Scope to specific high-risk applications\nList applicationNames = new ArrayList();\napplicationNames.add(\"Active Directory\");\napplicationNames.add(\"AWS IAM\");\napplicationNames.add(\"Oracle EBS\");\napplicationNames.add(\"SAP GRC\");\napplicationNames.add(\"CyberArk Vault\");\ntargetedCert.setApplicationNames(applicationNames);\n\n\u002F\u002F Filter for privileged entitlements only\nString entitlementFilter = \"entitlement.classification == \\\"Privileged\\\" \" +\n    \"|| entitlement.riskScore > 800 \" +\n    \"|| entitlement.name.contains(\\\"Admin\\\") \" +\n    \"|| entitlement.name.contains(\\\"Root\\\") \" +\n    \"|| entitlement.name.contains(\\\"DBA\\\")\";\ntargetedCert.setEntitlementFilter(entitlementFilter);\n\n\u002F\u002F Assign application owners as certifiers\ntargetedCert.setCertifierSelectionType(\n    CertificationDefinition.CertifierSelectionType.ApplicationOwner\n);\n\n\u002F\u002F Configure approval workflow\ntargetedCert.setApprovalRequired(true);\ntargetedCert.setSignOffRequired(true);\ntargetedCert.setReasonRequired(true);\n\n\u002F\u002F Enable SOD policy check during certification\ntargetedCert.setCheckSodPolicies(true);\ntargetedCert.setSodPolicyAction(CertificationDefinition.SodPolicyAction.Flag);\n\ncontext.saveObject(targetedCert);\ncontext.commitTransaction();\n```\n\n### Step 3: Implement SOD Policy Checks Within Certifications\n\nDefine Separation of Duties policies that flag violations during reviews:\n\n```java\n\u002F\u002F Create SOD policy for financial system access conflicts\nimport sailpoint.object.*;\nimport sailpoint.object.Policy;\n\nPolicy sodPolicy = new Policy();\nsodPolicy.setName(\"Financial SOD - AP\u002FAR Conflict\");\nsodPolicy.setType(Policy.TYPE_SOD);\nsodPolicy.setDescription(\"Prevents users from having both Accounts Payable \" +\n    \"and Accounts Receivable access simultaneously\");\nsodPolicy.setViolationOwner(\n    context.getObjectByName(Identity.class, \"compliance-team\")\n);\n\n\u002F\u002F Define conflicting entitlements\nSODConstraint constraint = new SODConstraint();\nconstraint.setName(\"AP-AR Separation\");\n\n\u002F\u002F Left side: Accounts Payable entitlements\nPolicyConstraint leftSide = new PolicyConstraint();\nleftSide.setApplication(\"SAP ERP\");\nleftSide.addEntitlement(\"SAP_AP_PROCESSOR\");\nleftSide.addEntitlement(\"SAP_AP_APPROVER\");\nleftSide.addEntitlement(\"SAP_AP_ADMIN\");\nconstraint.setLeftConstraint(leftSide);\n\n\u002F\u002F Right side: Accounts Receivable entitlements\nPolicyConstraint rightSide = new PolicyConstraint();\nrightSide.setApplication(\"SAP ERP\");\nrightSide.addEntitlement(\"SAP_AR_PROCESSOR\");\nrightSide.addEntitlement(\"SAP_AR_APPROVER\");\nrightSide.addEntitlement(\"SAP_AR_ADMIN\");\nconstraint.setRightConstraint(rightSide);\n\n\u002F\u002F Set violation severity and remediation\nconstraint.setViolationSeverity(\"High\");\nconstraint.setCompensatingControl(\"Dual approval required for transactions > $10,000\");\n\nsodPolicy.addConstraint(constraint);\ncontext.saveObject(sodPolicy);\ncontext.commitTransaction();\n```\n\n### Step 4: Configure Revocation and Remediation Workflows\n\nAutomate access removal when certifiers revoke entitlements:\n\n```java\n\u002F\u002F Configure automatic provisioning for revoked entitlements\nimport sailpoint.object.*;\nimport sailpoint.api.*;\n\n\u002F\u002F Create remediation workflow\nWorkflow remediationWorkflow = new Workflow();\nremediationWorkflow.setName(\"Certification Revocation Workflow\");\nremediationWorkflow.setType(Workflow.Type.CertificationRemediation);\n\n\u002F\u002F Step 1: Create provisioning plan for revocation\nStep createPlan = new Step();\ncreatePlan.setName(\"Create Revocation Plan\");\ncreatePlan.setScript(\n    \"import sailpoint.object.ProvisioningPlan;\\n\" +\n    \"import sailpoint.object.ProvisioningPlan.AccountRequest;\\n\" +\n    \"import sailpoint.object.ProvisioningPlan.AttributeRequest;\\n\\n\" +\n    \"ProvisioningPlan plan = new ProvisioningPlan();\\n\" +\n    \"plan.setIdentity(identity);\\n\" +\n    \"AccountRequest acctReq = new AccountRequest();\\n\" +\n    \"acctReq.setApplication(applicationName);\\n\" +\n    \"acctReq.setOperation(AccountRequest.Operation.Modify);\\n\" +\n    \"AttributeRequest attrReq = new AttributeRequest();\\n\" +\n    \"attrReq.setName(entitlementAttribute);\\n\" +\n    \"attrReq.setValue(entitlementValue);\\n\" +\n    \"attrReq.setOperation(ProvisioningPlan.Operation.Remove);\\n\" +\n    \"acctReq.add(attrReq);\\n\" +\n    \"plan.add(acctReq);\\n\" +\n    \"return plan;\"\n);\n\n\u002F\u002F Step 2: Execute provisioning with retry logic\nStep executeProvisioning = new Step();\nexecuteProvisioning.setName(\"Execute Revocation\");\nexecuteProvisioning.setScript(\n    \"import sailpoint.api.Provisioner;\\n\" +\n    \"Provisioner provisioner = new Provisioner(context);\\n\" +\n    \"provisioner.setNoTriggers(false);\\n\" +\n    \"ProvisioningResult result = provisioner.execute(plan);\\n\" +\n    \"if (result.isCommitted()) {\\n\" +\n    \"    auditEvent(\\\"Entitlement revoked successfully\\\", identity, plan);\\n\" +\n    \"} else {\\n\" +\n    \"    openWorkItem(\\\"Manual revocation required\\\", identity, plan);\\n\" +\n    \"}\"\n);\n\n\u002F\u002F Step 3: Send notification to user and manager\nStep notification = new Step();\nnotification.setName(\"Send Revocation Notification\");\nnotification.setScript(\n    \"import sailpoint.tools.EmailTemplate;\\n\" +\n    \"EmailTemplate template = context.getObjectByName(\\n\" +\n    \"    EmailTemplate.class, \\\"Access Revocation Notification\\\");\\n\" +\n    \"Map args = new HashMap();\\n\" +\n    \"args.put(\\\"identityName\\\", identity.getDisplayName());\\n\" +\n    \"args.put(\\\"applicationName\\\", applicationName);\\n\" +\n    \"args.put(\\\"entitlementName\\\", entitlementValue);\\n\" +\n    \"args.put(\\\"certifierName\\\", certifier.getDisplayName());\\n\" +\n    \"args.put(\\\"revocationReason\\\", decisionReason);\\n\" +\n    \"context.sendEmailNotification(template, args);\"\n);\n\ncontext.saveObject(remediationWorkflow);\ncontext.commitTransaction();\n```\n\n### Step 5: Monitor Campaign Progress and Compliance Metrics\n\nTrack certification completion and generate compliance evidence:\n\n```java\n\u002F\u002F Campaign monitoring and reporting script\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport java.util.*;\n\n\u002F\u002F Get all active certification campaigns\nQueryOptions qo = new QueryOptions();\nqo.addFilter(Filter.eq(\"phase\", Certification.Phase.Active));\nIterator certIterator = context.search(Certification.class, qo);\n\nwhile (certIterator.hasNext()) {\n    Certification cert = certIterator.next();\n\n    System.out.println(\"Campaign: \" + cert.getName());\n    System.out.println(\"  Type: \" + cert.getType());\n    System.out.println(\"  Phase: \" + cert.getPhase());\n    System.out.println(\"  Due Date: \" + cert.getExpiration());\n\n    \u002F\u002F Get completion statistics\n    CertificationStats stats = cert.getStatistics();\n    int totalItems = stats.getTotalEntities();\n    int completedItems = stats.getCompletedEntities();\n    int pendingItems = totalItems - completedItems;\n    double completionPct = (completedItems * 100.0) \u002F totalItems;\n\n    System.out.println(\"  Total Items: \" + totalItems);\n    System.out.println(\"  Completed: \" + completedItems + \" (\" +\n        String.format(\"%.1f\", completionPct) + \"%)\");\n    System.out.println(\"  Pending: \" + pendingItems);\n\n    \u002F\u002F Decision breakdown\n    int approved = stats.getApprovedCount();\n    int revoked = stats.getRevokedCount();\n    int mitigated = stats.getMitigatedCount();\n    int delegated = stats.getDelegatedCount();\n\n    System.out.println(\"  Decisions:\");\n    System.out.println(\"    Approved: \" + approved);\n    System.out.println(\"    Revoked: \" + revoked);\n    System.out.println(\"    Mitigated: \" + mitigated);\n    System.out.println(\"    Delegated: \" + delegated);\n\n    \u002F\u002F Identify overdue certifiers\n    List certifiers = cert.getCertifiers();\n    for (Object certObj : certifiers) {\n        CertificationEntity entity = (CertificationEntity) certObj;\n        if (!entity.isCompleted() && cert.isOverdue()) {\n            System.out.println(\"  [OVERDUE] Certifier: \" +\n                entity.getCertifier().getDisplayName());\n        }\n    }\n    System.out.println();\n}\n```\n\n### Step 6: Generate Audit Evidence and Reports\n\nExport certification results for auditor review:\n\n```java\n\u002F\u002F Generate audit report for completed certifications\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport sailpoint.tools.Util;\n\n\u002F\u002F Query completed certifications for the audit period\nQueryOptions qo = new QueryOptions();\nqo.addFilter(Filter.eq(\"phase\", Certification.Phase.End));\nqo.addFilter(Filter.ge(\"signed\", Util.stringToDate(\"2026-01-01\")));\nqo.addFilter(Filter.le(\"signed\", Util.stringToDate(\"2026-03-31\")));\n\nList results = context.getObjects(Certification.class, qo);\n\nStringBuilder auditReport = new StringBuilder();\nauditReport.append(\"ACCESS CERTIFICATION AUDIT REPORT\\n\");\nauditReport.append(\"Period: Q1 2026\\n\");\nauditReport.append(\"Generated: \" + new Date() + \"\\n\");\nauditReport.append(\"=\".repeat(50) + \"\\n\\n\");\n\nint totalCampaigns = 0;\nint totalDecisions = 0;\nint totalRevocations = 0;\n\nfor (Certification cert : results) {\n    totalCampaigns++;\n    CertificationStats stats = cert.getStatistics();\n\n    auditReport.append(\"Campaign: \" + cert.getName() + \"\\n\");\n    auditReport.append(\"  Certifier: \" + cert.getCertifiers().size() + \" reviewers\\n\");\n    auditReport.append(\"  Items Reviewed: \" + stats.getTotalEntities() + \"\\n\");\n    auditReport.append(\"  Approved: \" + stats.getApprovedCount() + \"\\n\");\n    auditReport.append(\"  Revoked: \" + stats.getRevokedCount() + \"\\n\");\n    auditReport.append(\"  Completed: \" + cert.getSigned() + \"\\n\");\n    auditReport.append(\"  Sign-off: \" + (cert.isSignedOff() ? \"YES\" : \"NO\") + \"\\n\\n\");\n\n    totalDecisions += stats.getTotalEntities();\n    totalRevocations += stats.getRevokedCount();\n}\n\nauditReport.append(\"SUMMARY\\n\");\nauditReport.append(\"Total Campaigns: \" + totalCampaigns + \"\\n\");\nauditReport.append(\"Total Decisions: \" + totalDecisions + \"\\n\");\nauditReport.append(\"Total Revocations: \" + totalRevocations + \"\\n\");\nauditReport.append(\"Revocation Rate: \" +\n    String.format(\"%.1f%%\", (totalRevocations * 100.0) \u002F totalDecisions));\n\nSystem.out.println(auditReport.toString());\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Certification Campaign** | An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications |\n| **Access Review** | Individual review unit within a campaign where a certifier examines and makes approve\u002Frevoke decisions on specific user entitlements |\n| **Entitlement** | A specific permission, group membership, role, or access right granted to an identity on a target application |\n| **Certifier** | The reviewer responsible for making access decisions, typically a manager, application owner, or data owner |\n| **Revocation** | Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal |\n| **SOD Violation** | Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk |\n| **Remediation** | Automated or manual process of removing revoked access from target systems following certification decisions |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ**: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting\n- **IdentityIQ Compliance Manager**: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence\n- **SailPoint REST API**: Programmatic interface for automating certification campaigns, querying status, and extracting audit data\n- **IdentityIQ Report Builder**: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis\n\n## Common Scenarios\n\n### Scenario: SOX Compliance Quarterly Access Review\n\n**Context**: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.\n\n**Approach**:\n1. Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems\n2. Configure manager certifications with 30-day active period for general access review\n3. Create targeted entitlement certifications for privileged financial roles with application owner as certifier\n4. Enable SOD policy checks to flag AP\u002FAR, GL posting\u002Fapproval, and user admin\u002Ftransaction conflicts\n5. Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25\n6. Set default-revoke for items not reviewed by campaign end to enforce completion accountability\n7. Generate signed certification reports with decision audit trail for external auditors\n8. Track revocation completion to ensure all denied access is actually removed from target systems\n\n**Pitfalls**:\n- Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand\n- Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews\n- Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)\n- Missing service accounts from review scope when they have access to financial systems\n\n## Output Format\n\n```\nACCESS CERTIFICATION CAMPAIGN REPORT\n=======================================\nCampaign:          Q1-2026 Manager Access Review\nType:              Manager Certification\nPeriod:            2026-01-15 to 2026-02-14\nStatus:            COMPLETED\n\nCOVERAGE\nIdentities Reviewed:    2,847\nApplications In Scope:  34\nTotal Entitlements:     18,392\n\nDECISION SUMMARY\nApproved:              16,841 (91.6%)\nRevoked:                1,203 (6.5%)\nMitigated:                 198 (1.1%)\nDelegated:                 150 (0.8%)\n\nREVOCATION STATUS\nProvisioned:            1,089 \u002F 1,203 (90.5%)\nPending:                   87\nFailed:                    27 (manual work items created)\n\nSOD VIOLATIONS\nFlagged:                   43\nRemediated:                31\nCompensating Controls:     12\n\nCERTIFIER COMPLIANCE\nOn-Time Completion:     89.3%\nRequired Escalation:    14 certifiers\nAverage Review Time:    3.2 minutes per item\n\nSIGN-OFF\nCampaign Signed:        2026-02-14 by compliance-admin\nAudit Evidence:         Exported to \u002Freports\u002FQ1-2026-cert-evidence.pdf\n```\n","# Performing Entitlement Review with SailPoint IdentityIQ\n\n## When to Use\n\n- Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS)\n- Organization needs automated manager-based access reviews for all direct reports\n- Targeted entitlement reviews are needed for sensitive applications or high-privilege roles\n- Separation of Duties (SOD) violations must be identified and remediated\n- Orphaned accounts and excessive entitlements need to be discovered and cleaned up\n- Audit findings require evidence of periodic access review and remediation tracking\n\n**Do not use** for real-time access control decisions; IdentityIQ certifications are periodic review processes designed for governance and compliance validation.\n\n## Prerequisites\n\n- SailPoint IdentityIQ 8.2+ deployed with database backend (Oracle, MySQL, or SQL Server)\n- Application connectors configured for all in-scope systems (Active Directory, LDAP, databases, SaaS applications)\n- Identity cubes aggregated with current entitlement data from all connected sources\n- Email server configured for certification notifications\n- Manager hierarchy defined in the identity model\n- Business roles and entitlement glossary populated for reviewer context\n\n## Workflow\n\n### Step 1: Define Certification Campaign Strategy\n\nPlan the certification scope and reviewer assignments:\n\n```java\n\u002F\u002F SailPoint IdentityIQ BeanShell - Campaign Configuration\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport java.util.*;\n\n\u002F\u002F Define campaign schedule for quarterly manager certifications\nCertificationSchedule schedule = new CertificationSchedule();\nschedule.setName(\"Q1-2026-Manager-Access-Review\");\nschedule.setDescription(\"Quarterly manager certification for all active employees\");\nschedule.setType(Certification.Type.Manager);\n\n\u002F\u002F Configure campaign scope\nCertificationDefinition certDef = new CertificationDefinition();\ncertDef.setName(\"Q1 Manager Certification\");\ncertDef.setOwner(context.getObjectByName(Identity.class, \"cert-admin\"));\n\n\u002F\u002F Set certification options\ncertDef.setCertifierSelectionType(CertificationDefinition.CertifierSelectionType.Manager);\ncertDef.setIncludeEntitlements(true);\ncertDef.setIncludeRoles(true);\ncertDef.setIncludeAccounts(true);\ncertDef.setIncludeAdditionalEntitlements(true);\n\n\u002F\u002F Exclude service accounts from manager reviews\nFilter exclusionFilter = Filter.ne(\"type\", \"service\");\ncertDef.setExclusionFilter(exclusionFilter);\n\n\u002F\u002F Configure notification settings\ncertDef.setNotificationEnabled(true);\ncertDef.setReminderFrequency(7); \u002F\u002F days\ncertDef.setEscalationEnabled(true);\ncertDef.setEscalationDays(14);\ncertDef.setEscalationRecipient(\"security-governance-team\");\n\n\u002F\u002F Set active period\ncertDef.setActivePeriodDays(30);\ncertDef.setAutoCloseEnabled(true);\ncertDef.setDefaultRevoke(true); \u002F\u002F Revoke if not reviewed\n\ncontext.saveObject(certDef);\ncontext.commitTransaction();\n```\n\n### Step 2: Configure Targeted Entitlement Certification\n\nSet up focused reviews for high-risk applications and privileged entitlements:\n\n```java\n\u002F\u002F Targeted certification for privileged access review\nimport sailpoint.object.*;\nimport sailpoint.api.*;\n\nCertificationDefinition targetedCert = new CertificationDefinition();\ntargetedCert.setName(\"Privileged Access Targeted Review\");\ntargetedCert.setType(Certification.Type.ApplicationOwner);\n\n\u002F\u002F Scope to specific high-risk applications\nList applicationNames = new ArrayList();\napplicationNames.add(\"Active Directory\");\napplicationNames.add(\"AWS IAM\");\napplicationNames.add(\"Oracle EBS\");\napplicationNames.add(\"SAP GRC\");\napplicationNames.add(\"CyberArk Vault\");\ntargetedCert.setApplicationNames(applicationNames);\n\n\u002F\u002F Filter for privileged entitlements only\nString entitlementFilter = \"entitlement.classification == \\\"Privileged\\\" \" +\n    \"|| entitlement.riskScore > 800 \" +\n    \"|| entitlement.name.contains(\\\"Admin\\\") \" +\n    \"|| entitlement.name.contains(\\\"Root\\\") \" +\n    \"|| entitlement.name.contains(\\\"DBA\\\")\";\ntargetedCert.setEntitlementFilter(entitlementFilter);\n\n\u002F\u002F Assign application owners as certifiers\ntargetedCert.setCertifierSelectionType(\n    CertificationDefinition.CertifierSelectionType.ApplicationOwner\n);\n\n\u002F\u002F Configure approval workflow\ntargetedCert.setApprovalRequired(true);\ntargetedCert.setSignOffRequired(true);\ntargetedCert.setReasonRequired(true);\n\n\u002F\u002F Enable SOD policy check during certification\ntargetedCert.setCheckSodPolicies(true);\ntargetedCert.setSodPolicyAction(CertificationDefinition.SodPolicyAction.Flag);\n\ncontext.saveObject(targetedCert);\ncontext.commitTransaction();\n```\n\n### Step 3: Implement SOD Policy Checks Within Certifications\n\nDefine Separation of Duties policies that flag violations during reviews:\n\n```java\n\u002F\u002F Create SOD policy for financial system access conflicts\nimport sailpoint.object.*;\nimport sailpoint.object.Policy;\n\nPolicy sodPolicy = new Policy();\nsodPolicy.setName(\"Financial SOD - AP\u002FAR Conflict\");\nsodPolicy.setType(Policy.TYPE_SOD);\nsodPolicy.setDescription(\"Prevents users from having both Accounts Payable \" +\n    \"and Accounts Receivable access simultaneously\");\nsodPolicy.setViolationOwner(\n    context.getObjectByName(Identity.class, \"compliance-team\")\n);\n\n\u002F\u002F Define conflicting entitlements\nSODConstraint constraint = new SODConstraint();\nconstraint.setName(\"AP-AR Separation\");\n\n\u002F\u002F Left side: Accounts Payable entitlements\nPolicyConstraint leftSide = new PolicyConstraint();\nleftSide.setApplication(\"SAP ERP\");\nleftSide.addEntitlement(\"SAP_AP_PROCESSOR\");\nleftSide.addEntitlement(\"SAP_AP_APPROVER\");\nleftSide.addEntitlement(\"SAP_AP_ADMIN\");\nconstraint.setLeftConstraint(leftSide);\n\n\u002F\u002F Right side: Accounts Receivable entitlements\nPolicyConstraint rightSide = new PolicyConstraint();\nrightSide.setApplication(\"SAP ERP\");\nrightSide.addEntitlement(\"SAP_AR_PROCESSOR\");\nrightSide.addEntitlement(\"SAP_AR_APPROVER\");\nrightSide.addEntitlement(\"SAP_AR_ADMIN\");\nconstraint.setRightConstraint(rightSide);\n\n\u002F\u002F Set violation severity and remediation\nconstraint.setViolationSeverity(\"High\");\nconstraint.setCompensatingControl(\"Dual approval required for transactions > $10,000\");\n\nsodPolicy.addConstraint(constraint);\ncontext.saveObject(sodPolicy);\ncontext.commitTransaction();\n```\n\n### Step 4: Configure Revocation and Remediation Workflows\n\nAutomate access removal when certifiers revoke entitlements:\n\n```java\n\u002F\u002F Configure automatic provisioning for revoked entitlements\nimport sailpoint.object.*;\nimport sailpoint.api.*;\n\n\u002F\u002F Create remediation workflow\nWorkflow remediationWorkflow = new Workflow();\nremediationWorkflow.setName(\"Certification Revocation Workflow\");\nremediationWorkflow.setType(Workflow.Type.CertificationRemediation);\n\n\u002F\u002F Step 1: Create provisioning plan for revocation\nStep createPlan = new Step();\ncreatePlan.setName(\"Create Revocation Plan\");\ncreatePlan.setScript(\n    \"import sailpoint.object.ProvisioningPlan;\\n\" +\n    \"import sailpoint.object.ProvisioningPlan.AccountRequest;\\n\" +\n    \"import sailpoint.object.ProvisioningPlan.AttributeRequest;\\n\\n\" +\n    \"ProvisioningPlan plan = new ProvisioningPlan();\\n\" +\n    \"plan.setIdentity(identity);\\n\" +\n    \"AccountRequest acctReq = new AccountRequest();\\n\" +\n    \"acctReq.setApplication(applicationName);\\n\" +\n    \"acctReq.setOperation(AccountRequest.Operation.Modify);\\n\" +\n    \"AttributeRequest attrReq = new AttributeRequest();\\n\" +\n    \"attrReq.setName(entitlementAttribute);\\n\" +\n    \"attrReq.setValue(entitlementValue);\\n\" +\n    \"attrReq.setOperation(ProvisioningPlan.Operation.Remove);\\n\" +\n    \"acctReq.add(attrReq);\\n\" +\n    \"plan.add(acctReq);\\n\" +\n    \"return plan;\"\n);\n\n\u002F\u002F Step 2: Execute provisioning with retry logic\nStep executeProvisioning = new Step();\nexecuteProvisioning.setName(\"Execute Revocation\");\nexecuteProvisioning.setScript(\n    \"import sailpoint.api.Provisioner;\\n\" +\n    \"Provisioner provisioner = new Provisioner(context);\\n\" +\n    \"provisioner.setNoTriggers(false);\\n\" +\n    \"ProvisioningResult result = provisioner.execute(plan);\\n\" +\n    \"if (result.isCommitted()) {\\n\" +\n    \"    auditEvent(\\\"Entitlement revoked successfully\\\", identity, plan);\\n\" +\n    \"} else {\\n\" +\n    \"    openWorkItem(\\\"Manual revocation required\\\", identity, plan);\\n\" +\n    \"}\"\n);\n\n\u002F\u002F Step 3: Send notification to user and manager\nStep notification = new Step();\nnotification.setName(\"Send Revocation Notification\");\nnotification.setScript(\n    \"import sailpoint.tools.EmailTemplate;\\n\" +\n    \"EmailTemplate template = context.getObjectByName(\\n\" +\n    \"    EmailTemplate.class, \\\"Access Revocation Notification\\\");\\n\" +\n    \"Map args = new HashMap();\\n\" +\n    \"args.put(\\\"identityName\\\", identity.getDisplayName());\\n\" +\n    \"args.put(\\\"applicationName\\\", applicationName);\\n\" +\n    \"args.put(\\\"entitlementName\\\", entitlementValue);\\n\" +\n    \"args.put(\\\"certifierName\\\", certifier.getDisplayName());\\n\" +\n    \"args.put(\\\"revocationReason\\\", decisionReason);\\n\" +\n    \"context.sendEmailNotification(template, args);\"\n);\n\ncontext.saveObject(remediationWorkflow);\ncontext.commitTransaction();\n```\n\n### Step 5: Monitor Campaign Progress and Compliance Metrics\n\nTrack certification completion and generate compliance evidence:\n\n```java\n\u002F\u002F Campaign monitoring and reporting script\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport java.util.*;\n\n\u002F\u002F Get all active certification campaigns\nQueryOptions qo = new QueryOptions();\nqo.addFilter(Filter.eq(\"phase\", Certification.Phase.Active));\nIterator certIterator = context.search(Certification.class, qo);\n\nwhile (certIterator.hasNext()) {\n    Certification cert = certIterator.next();\n\n    System.out.println(\"Campaign: \" + cert.getName());\n    System.out.println(\"  Type: \" + cert.getType());\n    System.out.println(\"  Phase: \" + cert.getPhase());\n    System.out.println(\"  Due Date: \" + cert.getExpiration());\n\n    \u002F\u002F Get completion statistics\n    CertificationStats stats = cert.getStatistics();\n    int totalItems = stats.getTotalEntities();\n    int completedItems = stats.getCompletedEntities();\n    int pendingItems = totalItems - completedItems;\n    double completionPct = (completedItems * 100.0) \u002F totalItems;\n\n    System.out.println(\"  Total Items: \" + totalItems);\n    System.out.println(\"  Completed: \" + completedItems + \" (\" +\n        String.format(\"%.1f\", completionPct) + \"%)\");\n    System.out.println(\"  Pending: \" + pendingItems);\n\n    \u002F\u002F Decision breakdown\n    int approved = stats.getApprovedCount();\n    int revoked = stats.getRevokedCount();\n    int mitigated = stats.getMitigatedCount();\n    int delegated = stats.getDelegatedCount();\n\n    System.out.println(\"  Decisions:\");\n    System.out.println(\"    Approved: \" + approved);\n    System.out.println(\"    Revoked: \" + revoked);\n    System.out.println(\"    Mitigated: \" + mitigated);\n    System.out.println(\"    Delegated: \" + delegated);\n\n    \u002F\u002F Identify overdue certifiers\n    List certifiers = cert.getCertifiers();\n    for (Object certObj : certifiers) {\n        CertificationEntity entity = (CertificationEntity) certObj;\n        if (!entity.isCompleted() && cert.isOverdue()) {\n            System.out.println(\"  [OVERDUE] Certifier: \" +\n                entity.getCertifier().getDisplayName());\n        }\n    }\n    System.out.println();\n}\n```\n\n### Step 6: Generate Audit Evidence and Reports\n\nExport certification results for auditor review:\n\n```java\n\u002F\u002F Generate audit report for completed certifications\nimport sailpoint.object.*;\nimport sailpoint.api.*;\nimport sailpoint.tools.Util;\n\n\u002F\u002F Query completed certifications for the audit period\nQueryOptions qo = new QueryOptions();\nqo.addFilter(Filter.eq(\"phase\", Certification.Phase.End));\nqo.addFilter(Filter.ge(\"signed\", Util.stringToDate(\"2026-01-01\")));\nqo.addFilter(Filter.le(\"signed\", Util.stringToDate(\"2026-03-31\")));\n\nList results = context.getObjects(Certification.class, qo);\n\nStringBuilder auditReport = new StringBuilder();\nauditReport.append(\"ACCESS CERTIFICATION AUDIT REPORT\\n\");\nauditReport.append(\"Period: Q1 2026\\n\");\nauditReport.append(\"Generated: \" + new Date() + \"\\n\");\nauditReport.append(\"=\".repeat(50) + \"\\n\\n\");\n\nint totalCampaigns = 0;\nint totalDecisions = 0;\nint totalRevocations = 0;\n\nfor (Certification cert : results) {\n    totalCampaigns++;\n    CertificationStats stats = cert.getStatistics();\n\n    auditReport.append(\"Campaign: \" + cert.getName() + \"\\n\");\n    auditReport.append(\"  Certifier: \" + cert.getCertifiers().size() + \" reviewers\\n\");\n    auditReport.append(\"  Items Reviewed: \" + stats.getTotalEntities() + \"\\n\");\n    auditReport.append(\"  Approved: \" + stats.getApprovedCount() + \"\\n\");\n    auditReport.append(\"  Revoked: \" + stats.getRevokedCount() + \"\\n\");\n    auditReport.append(\"  Completed: \" + cert.getSigned() + \"\\n\");\n    auditReport.append(\"  Sign-off: \" + (cert.isSignedOff() ? \"YES\" : \"NO\") + \"\\n\\n\");\n\n    totalDecisions += stats.getTotalEntities();\n    totalRevocations += stats.getRevokedCount();\n}\n\nauditReport.append(\"SUMMARY\\n\");\nauditReport.append(\"Total Campaigns: \" + totalCampaigns + \"\\n\");\nauditReport.append(\"Total Decisions: \" + totalDecisions + \"\\n\");\nauditReport.append(\"Total Revocations: \" + totalRevocations + \"\\n\");\nauditReport.append(\"Revocation Rate: \" +\n    String.format(\"%.1f%%\", (totalRevocations * 100.0) \u002F totalDecisions));\n\nSystem.out.println(auditReport.toString());\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Certification Campaign** | An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications |\n| **Access Review** | Individual review unit within a campaign where a certifier examines and makes approve\u002Frevoke decisions on specific user entitlements |\n| **Entitlement** | A specific permission, group membership, role, or access right granted to an identity on a target application |\n| **Certifier** | The reviewer responsible for making access decisions, typically a manager, application owner, or data owner |\n| **Revocation** | Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal |\n| **SOD Violation** | Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk |\n| **Remediation** | Automated or manual process of removing revoked access from target systems following certification decisions |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ**: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting\n- **IdentityIQ Compliance Manager**: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence\n- **SailPoint REST API**: Programmatic interface for automating certification campaigns, querying status, and extracting audit data\n- **IdentityIQ Report Builder**: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis\n\n## Common Scenarios\n\n### Scenario: SOX Compliance Quarterly Access Review\n\n**Context**: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.\n\n**Approach**:\n1. Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems\n2. Configure manager certifications with 30-day active period for general access review\n3. Create targeted entitlement certifications for privileged financial roles with application owner as certifier\n4. Enable SOD policy checks to flag AP\u002FAR, GL posting\u002Fapproval, and user admin\u002Ftransaction conflicts\n5. Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25\n6. Set default-revoke for items not reviewed by campaign end to enforce completion accountability\n7. Generate signed certification reports with decision audit trail for external auditors\n8. Track revocation completion to ensure all denied access is actually removed from target systems\n\n**Pitfalls**:\n- Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand\n- Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews\n- Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)\n- Missing service accounts from review scope when they have access to financial systems\n\n## Output Format\n\n```\nACCESS CERTIFICATION CAMPAIGN REPORT\n=======================================\nCampaign:          Q1-2026 Manager Access Review\nType:              Manager Certification\nPeriod:            2026-01-15 to 2026-02-14\nStatus:            COMPLETED\n\nCOVERAGE\nIdentities Reviewed:    2,847\nApplications In Scope:  34\nTotal Entitlements:     18,392\n\nDECISION SUMMARY\nApproved:              16,841 (91.6%)\nRevoked:                1,203 (6.5%)\nMitigated:                 198 (1.1%)\nDelegated:                 150 (0.8%)\n\nREVOCATION STATUS\nProvisioned:            1,089 \u002F 1,203 (90.5%)\nPending:                   87\nFailed:                    27 (manual work items created)\n\nSOD VIOLATIONS\nFlagged:                   43\nRemediated:                31\nCompensating Controls:     12\n\nCERTIFIER COMPLIANCE\nOn-Time Completion:     89.3%\nRequired Escalation:    14 certifiers\nAverage Review Time:    3.2 minutes per item\n\nSIGN-OFF\nCampaign Signed:        2026-02-14 by compliance-admin\nAudit Evidence:         Exported to \u002Freports\u002FQ1-2026-cert-evidence.pdf\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"mitre_f3":53,"nist_csf":77,"subdomain":82,"description":7,"mitre_attack":83},[50,30,31,29,36,28],"SailPoint","mahipal","1.0",{"tactics":54,"version":58,"techniques":59},[33,55,56,57],"positioning","defense-impairment","resource-development","1.1",[60,64,68,71,74],{"id":61,"name":62,"source":63,"tactic":57},"T1586","Compromise Accounts","attack",{"id":65,"name":66,"source":67,"tactic":33},"F1033","Insider Access Abuse","f3",{"id":69,"name":70,"source":67,"tactic":55},"F1005","Account Manipulation",{"id":72,"name":73,"source":67,"tactic":55},"F1005.002","Account Manipulation: Add Authorized User",{"id":75,"name":76,"source":67,"tactic":56},"F1005.007","Account Manipulation: Enable Account Features",[78,79,80,81],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[84,85,86,87],"T1078","T1110","T1556","T1098","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-entitlement-review-with-sailpoint-iiq",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":99,"prompt":109,"zipAvailable":110},[100,103,106],{"tool":101,"command":102},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-entitlement-review-with-sailpoint-iiq",{"tool":104,"command":105},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-entitlement-review-with-sailpoint-iiq",{"tool":107,"command":108},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-entitlement-review-with-sailpoint-iiq","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-entitlement-review-with-sailpoint-iiq\u002FSKILL.md",true,[112,117,123],{"path":113,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-entitlement-review-with-sailpoint-iiq\u002FLICENSE",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fapi-reference.md","REFERENCE","参考文档",2030,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-entitlement-review-with-sailpoint-iiq\u002Freferences\u002Fapi-reference.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",6840,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-entitlement-review-with-sailpoint-iiq\u002Fscripts\u002Fagent.py",[130,155,179,206,232,258],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,139,140,141,142,43,143,41,39,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,142,166,43,39,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,43,194,195,167,196,197,198,199,200,201,34,202,203,204,205],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,43,217,218,219,220,221,222,223,224,225,226,227,228,170,229,230,231],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,43,243,244,245,246,247,248,249,250,251,35,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,266,43,267,268,269,270,271,272,273,274,34,275,202,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]