[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG1S4RZ6TP24TNJ8WWC9GY":3,"skill-same:01M6AG1S4RZ6TP24TNJ8WWC9GY":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AG1S4RZ6TP24TNJ8WWC9GY","performing-service-account-audit",null,"Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"audit","performing service account audit","directory","cybersecurity","identity","governance","pr","infrastructure","cloud","Enterprise","access-control","iam","service-accounts","t1078","t1098","discovery","2026-11-10 10:12:30",false,"---\nname: performing-service-account-audit\ndescription: Audit service accounts across enterprise infrastructure to identify orphaned,\n  over-privileged, and non-compliant accounts. This skill covers discovery of service\n  accounts in Active Directory, cloud pl\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- iam\n- identity\n- access-control\n- service-accounts\n- audit\n- governance\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n- T1069\n---\n# Performing Service Account Audit\n\n## Overview\nAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing service account audit\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Discover all service accounts across AD, cloud, databases, and applications\n- Identify orphaned accounts with no valid owner or associated application\n- Assess privilege levels and flag over-privileged service accounts\n- Check for non-rotating passwords and weak authentication\n- Map service account dependencies for safe remediation\n- Generate compliance reports for SOX, PCI DSS, and HIPAA audits\n\n## Key Concepts\n\n### Service Account Types\n1. **AD Service Accounts**: Windows services, scheduled tasks, IIS app pools\n2. **Managed Service Accounts (gMSA)**: AD-managed automatic password rotation\n3. **Cloud IAM Service Accounts**: AWS IAM roles\u002Fusers, Azure service principals, GCP service accounts\n4. **Database Service Accounts**: Application connection accounts, replication accounts\n5. **Application Service Accounts**: API keys, bot accounts, integration accounts\n\n### Audit Dimensions\n- **Ownership**: Who is responsible for this account?\n- **Purpose**: What application\u002Fservice uses this account?\n- **Privileges**: What permissions does this account have?\n- **Authentication**: How does this account authenticate (password, key, certificate)?\n- **Rotation**: When was the credential last changed?\n- **Activity**: When was this account last used?\n\n## Workflow\n\n### Step 1: Discovery - Active Directory\n1. Query AD for all service accounts (filter by description, OU, naming convention)\n2. Identify accounts with `ServicePrincipalName` set\n3. List accounts in privileged groups (Domain Admins, Enterprise Admins)\n4. Check for gMSA vs traditional service accounts\n5. Identify accounts with `PasswordNeverExpires` flag\n\n### Step 2: Discovery - Cloud Platforms\n- **AWS**: List IAM users with access keys, check last used date, identify unused roles\n- **Azure**: Enumerate service principals, app registrations, managed identities\n- **GCP**: List service accounts, check key age, identify unused permissions\n\n### Step 3: Assessment\n- Flag accounts with admin\u002Fprivileged group membership\n- Check password age against rotation policy (90 days max)\n- Identify accounts with no login activity in 90+ days\n- Verify account ownership against CMDB\u002Fasset inventory\n- Check for shared credentials (same password hash across accounts)\n\n### Step 4: Risk Classification\n- **Critical**: Domain\u002Fcloud admin privileges, no password rotation\n- **High**: Access to sensitive data, no identified owner\n- **Medium**: Standard service permissions, password older than 90 days\n- **Low**: Read-only access, managed credentials (gMSA, managed identity)\n\n### Step 5: Remediation\n- Disable orphaned accounts after validation with application teams\n- Convert traditional service accounts to gMSA where possible\n- Rotate credentials older than policy threshold\n- Reduce privileges to minimum required\n- Assign owners and document dependencies\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Account Management | AC-2 | Service account lifecycle |\n| Account Review | AC-2(3) | Periodic review of accounts |\n| Least Privilege | AC-6 | Minimum service account permissions |\n| Authenticator Management | IA-5 | Service credential rotation |\n| Audit Review | AU-6 | Review service account activity |\n\n## Common Pitfalls\n- Disabling service accounts without verifying application dependencies first\n- Not discovering service accounts outside of Active Directory\n- Missing cloud service principals and managed identities\n- Not checking for interactive logon rights on service accounts\n- Failing to document dependencies before remediation\n\n## Verification\n- [ ] Service accounts inventoried across all platforms\n- [ ] Each account has assigned owner\n- [ ] Privileged service accounts documented with justification\n- [ ] Password rotation compliance checked\n- [ ] Orphaned accounts flagged for remediation\n- [ ] gMSA migration candidates identified\n- [ ] Compliance report generated\n","# Performing Service Account Audit\n\n## Overview\nAudit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud platforms, databases, and applications, assessing privilege levels, identifying missing owners, and enforcing lifecycle policies.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing service account audit\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with identity access management concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n- Discover all service accounts across AD, cloud, databases, and applications\n- Identify orphaned accounts with no valid owner or associated application\n- Assess privilege levels and flag over-privileged service accounts\n- Check for non-rotating passwords and weak authentication\n- Map service account dependencies for safe remediation\n- Generate compliance reports for SOX, PCI DSS, and HIPAA audits\n\n## Key Concepts\n\n### Service Account Types\n1. **AD Service Accounts**: Windows services, scheduled tasks, IIS app pools\n2. **Managed Service Accounts (gMSA)**: AD-managed automatic password rotation\n3. **Cloud IAM Service Accounts**: AWS IAM roles\u002Fusers, Azure service principals, GCP service accounts\n4. **Database Service Accounts**: Application connection accounts, replication accounts\n5. **Application Service Accounts**: API keys, bot accounts, integration accounts\n\n### Audit Dimensions\n- **Ownership**: Who is responsible for this account?\n- **Purpose**: What application\u002Fservice uses this account?\n- **Privileges**: What permissions does this account have?\n- **Authentication**: How does this account authenticate (password, key, certificate)?\n- **Rotation**: When was the credential last changed?\n- **Activity**: When was this account last used?\n\n## Workflow\n\n### Step 1: Discovery - Active Directory\n1. Query AD for all service accounts (filter by description, OU, naming convention)\n2. Identify accounts with `ServicePrincipalName` set\n3. List accounts in privileged groups (Domain Admins, Enterprise Admins)\n4. Check for gMSA vs traditional service accounts\n5. Identify accounts with `PasswordNeverExpires` flag\n\n### Step 2: Discovery - Cloud Platforms\n- **AWS**: List IAM users with access keys, check last used date, identify unused roles\n- **Azure**: Enumerate service principals, app registrations, managed identities\n- **GCP**: List service accounts, check key age, identify unused permissions\n\n### Step 3: Assessment\n- Flag accounts with admin\u002Fprivileged group membership\n- Check password age against rotation policy (90 days max)\n- Identify accounts with no login activity in 90+ days\n- Verify account ownership against CMDB\u002Fasset inventory\n- Check for shared credentials (same password hash across accounts)\n\n### Step 4: Risk Classification\n- **Critical**: Domain\u002Fcloud admin privileges, no password rotation\n- **High**: Access to sensitive data, no identified owner\n- **Medium**: Standard service permissions, password older than 90 days\n- **Low**: Read-only access, managed credentials (gMSA, managed identity)\n\n### Step 5: Remediation\n- Disable orphaned accounts after validation with application teams\n- Convert traditional service accounts to gMSA where possible\n- Rotate credentials older than policy threshold\n- Reduce privileges to minimum required\n- Assign owners and document dependencies\n\n## Security Controls\n| Control | NIST 800-53 | Description |\n|---------|-------------|-------------|\n| Account Management | AC-2 | Service account lifecycle |\n| Account Review | AC-2(3) | Periodic review of accounts |\n| Least Privilege | AC-6 | Minimum service account permissions |\n| Authenticator Management | IA-5 | Service credential rotation |\n| Audit Review | AU-6 | Review service account activity |\n\n## Common Pitfalls\n- Disabling service accounts without verifying application dependencies first\n- Not discovering service accounts outside of Active Directory\n- Missing cloud service principals and managed identities\n- Not checking for interactive logon rights on service accounts\n- Failing to document dependencies before remediation\n\n## Verification\n- [ ] Service accounts inventoried across all platforms\n- [ ] Each account has assigned owner\n- [ ] Privileged service accounts documented with justification\n- [ ] Password rotation compliance checked\n- [ ] Orphaned accounts flagged for remediation\n- [ ] gMSA migration candidates identified\n- [ ] Compliance report generated\n",{"name":5,"tags":45,"author":46,"domain":27,"license":15,"version":47,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54},[35,28,34,36,24,29],"mahipal","1.0",[49,50,51,52],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[55,56,57,58,59],"T1078","T1110","T1556","T1098","T1069","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-service-account-audit",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-service-account-audit",{"tool":76,"command":77},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-service-account-audit",{"tool":79,"command":80},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-service-account-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002FSKILL.md",true,[84,90,95,101,105,109,115],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"assets\u002Ftemplate.md","ASSET","资产文件",926,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Fassets\u002Ftemplate.md",{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2296,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fstandards.md",885,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Freferences\u002Fstandards.md",{"path":106,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fworkflows.md",989,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Freferences\u002Fworkflows.md",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fagent.py","SCRIPT","脚本",6890,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Fscripts\u002Fagent.py",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fprocess.py",11739,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-service-account-audit\u002Fscripts\u002Fprocess.py",[120,145,169,195,221,248],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[126],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[128,129,130,131,132,27,133,28,30,134,135,136,137,138,139,140,141,142,143,144],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,141,154,155,132,156,27,30,157,158,159,160,161,162,163,164,165,166,167,168],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,180,181,182,183,27,31,184,157,185,186,187,188,189,190,37,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[203,204,205,27,206,207,208,209,210,211,212,213,214,215,216,217,160,218,219,220],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[227],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[229,230,231,27,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[254],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,256,27,257,258,259,260,261,262,263,264,37,265,191,266,267,268,269,270,271],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]