[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG63N61W0DEQZFS0G3V3M7":3,"skill-same:01M6AG63N61W0DEQZFS0G3V3M7":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AG63N61W0DEQZFS0G3V3M7","processing-stix-taxii-feeds",null,"Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"processing stix taxii feeds","stix","TAXII","feeds","NIST","TAXII-2.1","STIX-2.1","NIST-SP-800-150","collection","oasis","cortex","xsoar","cybersecurity","pipeline","MISP","ioc","cti","threat-intelligence","server","threat intelligence","2026-11-10 10:12:30",false,"---\nname: processing-stix-taxii-feeds\ndescription: 'Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1\n  servers, normalizing objects into platform-native schemas and routing them to appropriate\n  consuming systems. Use when onboarding new TAXII collection endpoints, automating\n  bi-directional intelligence sharing with ISACs, or building pipeline validation\n  for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server\n  configuration, MISP TAXII, or Cortex XSOAR feed integrations.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- STIX-2.1\n- TAXII-2.1\n- OASIS\n- MISP\n- CTI\n- IOC\n- threat-intelligence\n- NIST-SP-800-150\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Processing STIX\u002FTAXII Feeds\n\n## When to Use\n\nUse this skill when:\n- Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider\n- Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import\n- Building automated pipelines that parse STIX relationship objects to reconstruct campaign context\n\n**Do not use** this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.\n\n## Prerequisites\n\n- Python 3.9+ with `stix2` library (pip install stix2) and `taxii2-client` library\n- Network access to TAXII 2.1 server endpoint with valid credentials\n- Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)\n\n## Workflow\n\n### Step 1: Discover TAXII Server Collections\n\n```python\nfrom taxii2client.v21 import Server, as_pages\n\nserver = Server(\"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002F\",\n                user=\"apiuser\", password=\"apikey\")\napi_root = server.api_roots[0]\nfor collection in api_root.collections:\n    print(collection.id, collection.title, collection.can_read)\n```\n\nSelect collections relevant to your threat profile. CISA AIS provides collections segmented by sector (financial, energy, healthcare).\n\n### Step 2: Fetch STIX Bundles with Pagination\n\n```python\nfrom taxii2client.v21 import Collection\nfrom datetime import datetime, timedelta, timezone\n\ncollection = Collection(\n    \"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002Fapi1\u002Fcollections\u002F\u003Cid>\u002Fobjects\u002F\",\n    user=\"apiuser\", password=\"apikey\")\n\n# Fetch only objects added in the last 24 hours\nadded_after = datetime.now(timezone.utc) - timedelta(hours=24)\nfor bundle_page in as_pages(collection.get_objects,\n                             added_after=added_after, per_request=100):\n    process_bundle(bundle_page)\n```\n\n### Step 3: Parse and Validate STIX Objects\n\n```python\nimport stix2\n\ndef process_bundle(bundle_dict):\n    bundle = stix2.parse(bundle_dict, allow_custom=True)\n    for obj in bundle.objects:\n        if obj.type == \"indicator\":\n            validate_indicator(obj)\n        elif obj.type == \"threat-actor\":\n            upsert_threat_actor(obj)\n        elif obj.type == \"relationship\":\n            link_objects(obj)\n\ndef validate_indicator(indicator):\n    required = [\"id\", \"type\", \"spec_version\", \"created\",\n                \"modified\", \"pattern\", \"pattern_type\", \"valid_from\"]\n    for field in required:\n        if not hasattr(indicator, field):\n            raise ValueError(f\"Missing required field: {field}\")\n    # Check confidence range\n    if hasattr(indicator, \"confidence\"):\n        assert 0 \u003C= indicator.confidence \u003C= 100\n```\n\n### Step 4: Route Objects to Consuming Platforms\n\nMap STIX object types to destination systems:\n- `indicator` objects → SIEM lookup tables and firewall blocklists\n- `malware` objects → EDR threat intelligence library\n- `threat-actor` \u002F `campaign` objects → TIP for analyst context\n- `course-of-action` objects → Security team wiki or SOAR playbook triggers\n\nUse TLP marking definitions to enforce sharing restrictions:\n```python\nfor marking in obj.get(\"object_marking_refs\", []):\n    if \"tlp-red\" in marking:\n        route_to_restricted_platform_only(obj)\n```\n\n### Step 5: Publish Back to TAXII (Bi-directional Sharing)\n\n```python\n# Add validated local intelligence back to shared collection\nnew_indicator = stix2.Indicator(\n    name=\"Malicious C2 Domain\",\n    pattern=\"[domain-name:value = 'evil-c2.example.com']\",\n    pattern_type=\"stix\",\n    valid_from=\"2025-01-15T00:00:00Z\",\n    confidence=80,\n    labels=[\"malicious-activity\"],\n    object_marking_refs=[\"marking-definition--34098fce-860f-479c-ae...\"]  # TLP:GREEN\n)\ncollection.add_objects(stix2.Bundle(new_indicator))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX Bundle** | Top-level STIX container object (type: \"bundle\") holding any number of STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs) |\n| **SDO** | STIX Domain Object — core intelligence types: indicator, threat-actor, malware, campaign, attack-pattern, course-of-action |\n| **SRO** | STIX Relationship Object — links two SDOs with a labeled relationship (e.g., \"uses\", \"attributed-to\", \"indicates\") |\n| **Pattern Language** | STIX pattern syntax for indicator conditions: `[network-traffic:dst_port = 443 AND ipv4-addr:value = '10.0.0.1']` |\n| **Marking Definition** | STIX object encoding TLP or statement restrictions on intelligence sharing |\n| **added_after** | TAXII 2.1 filter parameter (RFC 3339 timestamp) for incremental polling of new objects |\n\n## Tools & Systems\n\n- **stix2 (Python)**: Official OASIS Python library for creating, parsing, and validating STIX 2.0\u002F2.1 objects\n- **taxii2-client (Python)**: Client library for TAXII 2.0\u002F2.1 server discovery, collection enumeration, and object retrieval\n- **MISP**: Open-source TIP with native TAXII 2.1 server and client; MISP-TAXII-Server plugin for publishing MISP events\n- **OpenCTI**: CTI platform with built-in TAXII 2.1 connector; supports STIX 2.1 import\u002Fexport natively\n- **Cabby**: Legacy Python TAXII 1.x client for older government feeds still on TAXII 1.1\n\n## Common Pitfalls\n\n- **Ignoring `spec_version` field**: STIX 2.0 and 2.1 have incompatible schemas (2.1 adds `confidence`, `object_marking_refs` at bundle level). Always check `spec_version` before parsing.\n- **No pagination handling**: TAXII servers cap responses at 100–1000 objects per request. Missing pagination (via `next` link header) causes silent data loss.\n- **Clock skew on `added_after`**: Server and client time misalignment causes missed objects at interval boundaries. Use UTC exclusively and add 5-minute overlap windows.\n- **Storing raw STIX blobs without indexing**: Storing bundles as opaque JSON prevents querying by indicator type or campaign. Parse into relational or graph database.\n- **Sharing TLP:RED content inadvertently**: Automated pipelines must filter marking definitions before routing to any shared platform or SIEM with broad analyst access.\n","# Processing STIX\u002FTAXII Feeds\n\n## When to Use\n\nUse this skill when:\n- Onboarding a new TAXII 2.1 collection from a government feed (CISA AIS, FS-ISAC) or commercial provider\n- Validating that ingested STIX bundles conform to the OASIS STIX 2.1 specification before import\n- Building automated pipelines that parse STIX relationship objects to reconstruct campaign context\n\n**Do not use** this skill for proprietary vendor feed formats (Recorded Future JSON, CrowdStrike IOC lists) that require vendor-specific parsers rather than STIX processing.\n\n## Prerequisites\n\n- Python 3.9+ with `stix2` library (pip install stix2) and `taxii2-client` library\n- Network access to TAXII 2.1 server endpoint with valid credentials\n- Target TIP or SIEM with import API (MISP, OpenCTI, or Splunk ES)\n\n## Workflow\n\n### Step 1: Discover TAXII Server Collections\n\n```python\nfrom taxii2client.v21 import Server, as_pages\n\nserver = Server(\"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002F\",\n                user=\"apiuser\", password=\"apikey\")\napi_root = server.api_roots[0]\nfor collection in api_root.collections:\n    print(collection.id, collection.title, collection.can_read)\n```\n\nSelect collections relevant to your threat profile. CISA AIS provides collections segmented by sector (financial, energy, healthcare).\n\n### Step 2: Fetch STIX Bundles with Pagination\n\n```python\nfrom taxii2client.v21 import Collection\nfrom datetime import datetime, timedelta, timezone\n\ncollection = Collection(\n    \"https:\u002F\u002Fcti.example.com\u002Ftaxii\u002Fapi1\u002Fcollections\u002F\u003Cid>\u002Fobjects\u002F\",\n    user=\"apiuser\", password=\"apikey\")\n\n# Fetch only objects added in the last 24 hours\nadded_after = datetime.now(timezone.utc) - timedelta(hours=24)\nfor bundle_page in as_pages(collection.get_objects,\n                             added_after=added_after, per_request=100):\n    process_bundle(bundle_page)\n```\n\n### Step 3: Parse and Validate STIX Objects\n\n```python\nimport stix2\n\ndef process_bundle(bundle_dict):\n    bundle = stix2.parse(bundle_dict, allow_custom=True)\n    for obj in bundle.objects:\n        if obj.type == \"indicator\":\n            validate_indicator(obj)\n        elif obj.type == \"threat-actor\":\n            upsert_threat_actor(obj)\n        elif obj.type == \"relationship\":\n            link_objects(obj)\n\ndef validate_indicator(indicator):\n    required = [\"id\", \"type\", \"spec_version\", \"created\",\n                \"modified\", \"pattern\", \"pattern_type\", \"valid_from\"]\n    for field in required:\n        if not hasattr(indicator, field):\n            raise ValueError(f\"Missing required field: {field}\")\n    # Check confidence range\n    if hasattr(indicator, \"confidence\"):\n        assert 0 \u003C= indicator.confidence \u003C= 100\n```\n\n### Step 4: Route Objects to Consuming Platforms\n\nMap STIX object types to destination systems:\n- `indicator` objects → SIEM lookup tables and firewall blocklists\n- `malware` objects → EDR threat intelligence library\n- `threat-actor` \u002F `campaign` objects → TIP for analyst context\n- `course-of-action` objects → Security team wiki or SOAR playbook triggers\n\nUse TLP marking definitions to enforce sharing restrictions:\n```python\nfor marking in obj.get(\"object_marking_refs\", []):\n    if \"tlp-red\" in marking:\n        route_to_restricted_platform_only(obj)\n```\n\n### Step 5: Publish Back to TAXII (Bi-directional Sharing)\n\n```python\n# Add validated local intelligence back to shared collection\nnew_indicator = stix2.Indicator(\n    name=\"Malicious C2 Domain\",\n    pattern=\"[domain-name:value = 'evil-c2.example.com']\",\n    pattern_type=\"stix\",\n    valid_from=\"2025-01-15T00:00:00Z\",\n    confidence=80,\n    labels=[\"malicious-activity\"],\n    object_marking_refs=[\"marking-definition--34098fce-860f-479c-ae...\"]  # TLP:GREEN\n)\ncollection.add_objects(stix2.Bundle(new_indicator))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **STIX Bundle** | Top-level STIX container object (type: \"bundle\") holding any number of STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs) |\n| **SDO** | STIX Domain Object — core intelligence types: indicator, threat-actor, malware, campaign, attack-pattern, course-of-action |\n| **SRO** | STIX Relationship Object — links two SDOs with a labeled relationship (e.g., \"uses\", \"attributed-to\", \"indicates\") |\n| **Pattern Language** | STIX pattern syntax for indicator conditions: `[network-traffic:dst_port = 443 AND ipv4-addr:value = '10.0.0.1']` |\n| **Marking Definition** | STIX object encoding TLP or statement restrictions on intelligence sharing |\n| **added_after** | TAXII 2.1 filter parameter (RFC 3339 timestamp) for incremental polling of new objects |\n\n## Tools & Systems\n\n- **stix2 (Python)**: Official OASIS Python library for creating, parsing, and validating STIX 2.0\u002F2.1 objects\n- **taxii2-client (Python)**: Client library for TAXII 2.0\u002F2.1 server discovery, collection enumeration, and object retrieval\n- **MISP**: Open-source TIP with native TAXII 2.1 server and client; MISP-TAXII-Server plugin for publishing MISP events\n- **OpenCTI**: CTI platform with built-in TAXII 2.1 connector; supports STIX 2.1 import\u002Fexport natively\n- **Cabby**: Legacy Python TAXII 1.x client for older government feeds still on TAXII 1.1\n\n## Common Pitfalls\n\n- **Ignoring `spec_version` field**: STIX 2.0 and 2.1 have incompatible schemas (2.1 adds `confidence`, `object_marking_refs` at bundle level). Always check `spec_version` before parsing.\n- **No pagination handling**: TAXII servers cap responses at 100–1000 objects per request. Missing pagination (via `next` link header) causes silent data loss.\n- **Clock skew on `added_after`**: Server and client time misalignment causes missed objects at interval boundaries. Use UTC exclusively and add 5-minute overlap windows.\n- **Storing raw STIX blobs without indexing**: Storing bundles as opaque JSON prevents querying by indicator type or campaign. Parse into relational or graph database.\n- **Sharing TLP:RED content inadvertently**: Automated pipelines must filter marking definitions before routing to any shared platform or SIEM with broad analyst access.\n",{"name":5,"tags":49,"author":53,"domain":36,"license":15,"version":54,"nist_csf":55,"subdomain":41,"description":60,"mitre_attack":61},[30,29,50,38,51,52,41,31],"OASIS","CTI","IOC","mahipal","1.0.0",[56,57,58,59],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.\n",[62,63,64,65],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fprocessing-stix-taxii-feeds",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill processing-stix-taxii-feeds",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill processing-stix-taxii-feeds",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill processing-stix-taxii-feeds","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2282,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",8369,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprocessing-stix-taxii-feeds\u002Fscripts\u002Fagent.py",[108,134,158,186,211,238],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,120,36,121,122,123,124,125,126,127,37,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,120,145,36,123,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,36,173,174,146,175,176,177,178,179,180,181,182,183,184,185],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,36,197,198,199,200,201,202,203,204,205,206,207,208,149,32,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,36,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,246,36,247,248,39,249,250,28,251,252,181,253,182,254,255,256,257,258,259],"triaging security incident","siem","file","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]