[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFV00DMKE8D4DC31CK6R6H":3,"skill-same:01M6AFV00DMKE8D4DC31CK6R6H":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AFV00DMKE8D4DC31CK6R6H","performing-indicator-lifecycle-management",null,"Tracks IOCs through discovery, enrichment\u002Fvalidation (VirusTotal, Shodan, passive DNS), deployment to SIEM\u002FIDS watchlists, hit-rate and false-positive monitoring, confidence-score decay, and automated expiration using MISP\u002FOpenCTI and STIX. Use when building or maintaining a threat intelligence indicator lifecycle process, aging out stale IOCs, or reducing analyst fatigue from low-quality indicators.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing indicator lifecycle management","lifecycle","indicator","dns","ioc-management","indicator-lifecycle","false-positive","ids","Shodan","VirusTotal","cybersecurity","stix","ioc","cti","threat-intelligence","mitre-attack","monitoring","deployment","threat intelligence","siem","2026-11-10 10:12:30",false,"---\nname: performing-indicator-lifecycle-management\ndescription: Tracks IOCs through discovery, enrichment\u002Fvalidation (VirusTotal, Shodan,\n  passive DNS), deployment to SIEM\u002FIDS watchlists, hit-rate and false-positive monitoring,\n  confidence-score decay, and automated expiration using MISP\u002FOpenCTI and STIX. Use\n  when building or maintaining a threat intelligence indicator lifecycle process,\n  aging out stale IOCs, or reducing analyst fatigue from low-quality indicators.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- indicator-lifecycle\n- ioc-management\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Performing Indicator Lifecycle Management\n\n## Overview\n\nIndicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing indicator lifecycle management\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries\n- MISP or OpenCTI instance for indicator storage\n- SIEM with IOC watchlist capabilities (Splunk, Elastic)\n- Understanding of IOC types, confidence scoring, and TLP classifications\n\n## Key Concepts\n\n### Indicator Lifecycle Phases\n1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response\n2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)\n3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)\n4. **Deployment**: IOC pushed to detection systems (SIEM, IDS, firewall)\n5. **Monitoring**: Track hit rates, false positive rates, detection efficacy\n6. **Review**: Periodic assessment of IOC relevance and accuracy\n7. **Retirement**: IOC expired or removed based on aging policy\n\n### Confidence Decay\nIndicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).\n\n### Quality Metrics\n- **Hit Rate**: Percentage of deployed IOCs generating true positive alerts\n- **False Positive Rate**: Percentage of IOC alerts that are benign\n- **Coverage**: Percentage of known threat techniques with IOC coverage\n- **Freshness**: Average age of active indicators in the database\n\n## Workflow\n\n### Step 1: Implement IOC Lifecycle State Machine\n\n```python\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\nclass IOCState(Enum):\n    DISCOVERED = \"discovered\"\n    VALIDATED = \"validated\"\n    ENRICHED = \"enriched\"\n    DEPLOYED = \"deployed\"\n    MONITORING = \"monitoring\"\n    UNDER_REVIEW = \"under_review\"\n    RETIRED = \"retired\"\n\nclass IOCLifecycle:\n    def __init__(self, ioc_type, value, source, initial_confidence=50):\n        self.ioc_type = ioc_type\n        self.value = value\n        self.source = source\n        self.confidence = initial_confidence\n        self.state = IOCState.DISCOVERED\n        self.created = datetime.utcnow()\n        self.last_updated = datetime.utcnow()\n        self.last_seen = None\n        self.hit_count = 0\n        self.false_positive_count = 0\n        self.history = [{\"state\": \"discovered\", \"timestamp\": self.created.isoformat()}]\n\n    def transition(self, new_state: IOCState, reason=\"\"):\n        self.state = new_state\n        self.last_updated = datetime.utcnow()\n        self.history.append({\n            \"state\": new_state.value,\n            \"timestamp\": self.last_updated.isoformat(),\n            \"reason\": reason,\n        })\n\n    def apply_decay(self):\n        \"\"\"Apply confidence decay based on IOC type half-life.\"\"\"\n        half_lives = {\"ip\": 30, \"domain\": 90, \"hash\": 365, \"url\": 60}\n        half_life = half_lives.get(self.ioc_type, 90)\n        age_days = (datetime.utcnow() - self.created).days\n        decay_factor = 0.5 ** (age_days \u002F half_life)\n        self.confidence = max(0, int(self.confidence * decay_factor))\n\n    def record_hit(self, is_true_positive=True):\n        self.hit_count += 1\n        self.last_seen = datetime.utcnow()\n        if not is_true_positive:\n            self.false_positive_count += 1\n            if self.false_positive_count > 3:\n                self.transition(IOCState.UNDER_REVIEW, \"Excessive false positives\")\n\n    def should_retire(self):\n        max_ages = {\"ip\": 90, \"domain\": 180, \"hash\": 730, \"url\": 120}\n        max_age = max_ages.get(self.ioc_type, 180)\n        age_days = (datetime.utcnow() - self.created).days\n        return age_days > max_age and self.hit_count == 0\n```\n\n## Validation Criteria\n\n- IOC lifecycle state machine transitions correctly between phases\n- Confidence decay reduces scores based on IOC type half-life\n- Hit rate and false positive tracking functional\n- Aging policy automatically flags indicators for review\u002Fretirement\n- Quality metrics dashboard shows IOC database health\n\n## References\n\n- [MISP Indicator Lifecycle](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [IOC Quality Framework](https:\u002F\u002Fwww.first.org\u002F)\n","# Performing Indicator Lifecycle Management\n\n## Overview\n\nIndicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing indicator lifecycle management\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries\n- MISP or OpenCTI instance for indicator storage\n- SIEM with IOC watchlist capabilities (Splunk, Elastic)\n- Understanding of IOC types, confidence scoring, and TLP classifications\n\n## Key Concepts\n\n### Indicator Lifecycle Phases\n1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response\n2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)\n3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)\n4. **Deployment**: IOC pushed to detection systems (SIEM, IDS, firewall)\n5. **Monitoring**: Track hit rates, false positive rates, detection efficacy\n6. **Review**: Periodic assessment of IOC relevance and accuracy\n7. **Retirement**: IOC expired or removed based on aging policy\n\n### Confidence Decay\nIndicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).\n\n### Quality Metrics\n- **Hit Rate**: Percentage of deployed IOCs generating true positive alerts\n- **False Positive Rate**: Percentage of IOC alerts that are benign\n- **Coverage**: Percentage of known threat techniques with IOC coverage\n- **Freshness**: Average age of active indicators in the database\n\n## Workflow\n\n### Step 1: Implement IOC Lifecycle State Machine\n\n```python\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\nclass IOCState(Enum):\n    DISCOVERED = \"discovered\"\n    VALIDATED = \"validated\"\n    ENRICHED = \"enriched\"\n    DEPLOYED = \"deployed\"\n    MONITORING = \"monitoring\"\n    UNDER_REVIEW = \"under_review\"\n    RETIRED = \"retired\"\n\nclass IOCLifecycle:\n    def __init__(self, ioc_type, value, source, initial_confidence=50):\n        self.ioc_type = ioc_type\n        self.value = value\n        self.source = source\n        self.confidence = initial_confidence\n        self.state = IOCState.DISCOVERED\n        self.created = datetime.utcnow()\n        self.last_updated = datetime.utcnow()\n        self.last_seen = None\n        self.hit_count = 0\n        self.false_positive_count = 0\n        self.history = [{\"state\": \"discovered\", \"timestamp\": self.created.isoformat()}]\n\n    def transition(self, new_state: IOCState, reason=\"\"):\n        self.state = new_state\n        self.last_updated = datetime.utcnow()\n        self.history.append({\n            \"state\": new_state.value,\n            \"timestamp\": self.last_updated.isoformat(),\n            \"reason\": reason,\n        })\n\n    def apply_decay(self):\n        \"\"\"Apply confidence decay based on IOC type half-life.\"\"\"\n        half_lives = {\"ip\": 30, \"domain\": 90, \"hash\": 365, \"url\": 60}\n        half_life = half_lives.get(self.ioc_type, 90)\n        age_days = (datetime.utcnow() - self.created).days\n        decay_factor = 0.5 ** (age_days \u002F half_life)\n        self.confidence = max(0, int(self.confidence * decay_factor))\n\n    def record_hit(self, is_true_positive=True):\n        self.hit_count += 1\n        self.last_seen = datetime.utcnow()\n        if not is_true_positive:\n            self.false_positive_count += 1\n            if self.false_positive_count > 3:\n                self.transition(IOCState.UNDER_REVIEW, \"Excessive false positives\")\n\n    def should_retire(self):\n        max_ages = {\"ip\": 90, \"domain\": 180, \"hash\": 730, \"url\": 120}\n        max_age = max_ages.get(self.ioc_type, 180)\n        age_days = (datetime.utcnow() - self.created).days\n        return age_days > max_age and self.hit_count == 0\n```\n\n## Validation Criteria\n\n- IOC lifecycle state machine transitions correctly between phases\n- Confidence decay reduces scores based on IOC type half-life\n- Hit rate and false positive tracking functional\n- Aging policy automatically flags indicators for review\u002Fretirement\n- Quality metrics dashboard shows IOC database health\n\n## References\n\n- [MISP Indicator Lifecycle](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [IOC Quality Framework](https:\u002F\u002Fwww.first.org\u002F)\n",{"name":5,"tags":49,"author":50,"domain":34,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":7,"mitre_attack":57},[38,37,36,39,35,29,28],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[58,59,60,61],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-indicator-lifecycle-management",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-indicator-lifecycle-management",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-indicator-lifecycle-management",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-indicator-lifecycle-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002FSKILL.md",true,[86,92,97,103,107,111,117],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Ftemplate.md","ASSET","资产文件",1004,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Fassets\u002Ftemplate.md",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1593,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",1156,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fworkflows.md",1409,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Freferences\u002Fworkflows.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",6505,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Fscripts\u002Fagent.py",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fprocess.py",4487,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-indicator-lifecycle-management\u002Fscripts\u002Fprocess.py",[122,149,173,201,227,254],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,134,34,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,134,160,34,137,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,34,188,189,161,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,34,212,213,214,215,216,217,218,219,220,221,222,223,164,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,34,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,262,34,43,263,36,264,265,266,267,268,196,269,197,270,271,272,273,274,275],"triaging security incident","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]