[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG821HS7A7KNPJEKCQ3KBC":3,"skill-same:01M6AG821HS7A7KNPJEKCQ3KBC":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6AG821HS7A7KNPJEKCQ3KBC","scanning-infrastructure-with-nessus",null,"Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"infrastructure","nessus","scanning infrastructure with nessus","security","cybersecurity","cve","network","vulnerability-management","risk","devices","tenable","vulnerability","vulnerability scanner","infrastructure-scanning","2026-11-10 10:12:30",false,"---\nname: scanning-infrastructure-with-nessus\ndescription: Tenable Nessus is the industry-leading vulnerability scanner used to\n  identify security weaknesses across network infrastructure including servers, workstations,\n  network devices, and operating systems.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- vulnerability-management\n- cve\n- nessus\n- tenable\n- infrastructure-scanning\n- risk\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n- T1046\n---\n# Scanning Infrastructure with Nessus\n\n## Overview\nTenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning infrastructure with nessus\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nessus Professional or Essentials license installed and activated\n- Network access to target systems (firewall rules allowing scanner IP)\n- Administrative credentials for authenticated scanning\n- Understanding of TCP\u002FIP networking and common services\n- Written authorization for scanning target environments\n\n## Core Concepts\n\n### Nessus Architecture\nNessus operates as a client-server application where the Nessus scanner engine runs as a service (nessusd) on the host system. It uses a plugin-based architecture with over 200,000 plugins updated weekly by Tenable's research team. Each plugin tests for a specific vulnerability, misconfiguration, or compliance check.\n\n### Scan Types\n1. **Host Discovery** - Identifies live hosts using ICMP, TCP, UDP, and ARP\n2. **Basic Network Scan** - Default policy covering common vulnerabilities\n3. **Advanced Scan** - Custom policy with granular plugin selection\n4. **Credentialed Patch Audit** - Authenticated scan checking installed patches\n5. **Web Application Tests** - Scans for web-specific vulnerabilities\n6. **Compliance Audit** - Checks against CIS, DISA STIG, PCI DSS benchmarks\n\n### Plugin Families\nNessus organizes plugins into families including:\n- **Operating Systems**: Windows, Linux, macOS, Solaris\n- **Network Devices**: Cisco, Juniper, Palo Alto, Fortinet\n- **Web Servers**: Apache, Nginx, IIS, Tomcat\n- **Databases**: Oracle, MySQL, PostgreSQL, MSSQL\n- **Services**: DNS, SMTP, FTP, SSH, SNMP\n\n## Workflow\n\n### Step 1: Initial Configuration\n```bash\n# Start Nessus service\nsudo systemctl start nessusd\nsudo systemctl enable nessusd\n\n# CLI management with nessuscli\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli update --all\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli fix --list\n\n# Verify plugin count\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli update --plugins-only\n```\n\n### Step 2: Create Scan Policy\nConfigure a custom scan policy through the Nessus web UI at https:\u002F\u002Flocalhost:8834:\n\n1. Navigate to Policies > New Policy > Advanced Scan\n2. Configure General settings: name, description, targets\n3. Set Discovery settings:\n   - Host Discovery: Ping methods (ICMP, TCP SYN on ports 22,80,443)\n   - Port Scanning: SYN scan on common ports or all 65535 ports\n   - Service Discovery: Probe all ports for services\n4. Configure Assessment settings:\n   - Accuracy: Override normal accuracy (reduce false positives)\n   - Web Applications: Enable if scanning web servers\n5. Select Plugin families relevant to target environment\n\n### Step 3: Configure Credentials\nFor authenticated scanning, configure credentials under the Credentials tab:\n- **SSH**: Username\u002Fpassword or SSH key pair\n- **Windows**: Domain credentials via SMB, WMI\n- **SNMP**: Community strings (v1\u002Fv2c) or USM credentials (v3)\n- **Database**: Oracle, MySQL, PostgreSQL connection strings\n- **VMware**: vCenter or ESXi credentials\n\n### Step 4: Run the Scan\n```\n# Using Nessus REST API via curl\n# Authenticate and get token\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fsession \\\n  -d '{\"username\":\"admin\",\"password\":\"password\"}' \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Create scan\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fscans \\\n  -H \"X-Cookie: token=\u003CTOKEN>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"uuid\": \"\u003CTEMPLATE_UUID>\",\n    \"settings\": {\n      \"name\": \"Infrastructure Scan Q1\",\n      \"text_targets\": \"192.168.1.0\u002F24\",\n      \"enabled\": true,\n      \"launch\": \"ON_DEMAND\"\n    }\n  }'\n\n# Launch scan\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID>\u002Flaunch \\\n  -H \"X-Cookie: token=\u003CTOKEN>\"\n\n# Check scan status\ncurl -k -X GET https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID> \\\n  -H \"X-Cookie: token=\u003CTOKEN>\"\n```\n\n### Step 5: Analyze Results\nNessus categorizes findings by severity:\n- **Critical (CVSS 9.0-10.0)**: Immediate remediation required\n- **High (CVSS 7.0-8.9)**: Remediate within 7-14 days\n- **Medium (CVSS 4.0-6.9)**: Remediate within 30 days\n- **Low (CVSS 0.1-3.9)**: Remediate during next maintenance window\n- **Informational**: No immediate action required\n\n### Step 6: Export and Report\n```bash\n# Export via REST API\ncurl -k -X POST \"https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID>\u002Fexport\" \\\n  -H \"X-Cookie: token=\u003CTOKEN>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"format\":\"nessus\"}'\n\n# Supported formats: nessus (XML), csv, html, pdf\n```\n\n## Best Practices\n1. Schedule scans during maintenance windows to minimize production impact\n2. Use authenticated scanning for 45-60% more vulnerability detection\n3. Exclude fragile systems (medical devices, legacy SCADA) from aggressive scans\n4. Maintain separate scan policies for different network segments\n5. Update plugins before every scan to catch recently disclosed CVEs\n6. Validate critical findings manually before escalating to remediation teams\n7. Implement scan result trending to track remediation progress over time\n8. Store scan results in Tenable.sc or Tenable.io for centralized management\n\n## Common Pitfalls\n- Running unauthenticated scans only (misses 45-60% of vulnerabilities)\n- Scanning without written authorization (legal and ethical violations)\n- Ignoring scan performance impact on production systems\n- Failing to tune plugins leading to excessive false positives\n- Not validating scanner network connectivity before launching scans\n- Using default scan policies without customization for the environment\n\n## Related Skills\n- performing-authenticated-vulnerability-scan\n- prioritizing-vulnerabilities-with-cvss-scoring\n- implementing-continuous-vulnerability-monitoring\n- performing-network-vulnerability-assessment\n","# Scanning Infrastructure with Nessus\n\n## Overview\nTenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.\n\n\n## When to Use\n\n- When conducting security assessments that involve scanning infrastructure with nessus\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Nessus Professional or Essentials license installed and activated\n- Network access to target systems (firewall rules allowing scanner IP)\n- Administrative credentials for authenticated scanning\n- Understanding of TCP\u002FIP networking and common services\n- Written authorization for scanning target environments\n\n## Core Concepts\n\n### Nessus Architecture\nNessus operates as a client-server application where the Nessus scanner engine runs as a service (nessusd) on the host system. It uses a plugin-based architecture with over 200,000 plugins updated weekly by Tenable's research team. Each plugin tests for a specific vulnerability, misconfiguration, or compliance check.\n\n### Scan Types\n1. **Host Discovery** - Identifies live hosts using ICMP, TCP, UDP, and ARP\n2. **Basic Network Scan** - Default policy covering common vulnerabilities\n3. **Advanced Scan** - Custom policy with granular plugin selection\n4. **Credentialed Patch Audit** - Authenticated scan checking installed patches\n5. **Web Application Tests** - Scans for web-specific vulnerabilities\n6. **Compliance Audit** - Checks against CIS, DISA STIG, PCI DSS benchmarks\n\n### Plugin Families\nNessus organizes plugins into families including:\n- **Operating Systems**: Windows, Linux, macOS, Solaris\n- **Network Devices**: Cisco, Juniper, Palo Alto, Fortinet\n- **Web Servers**: Apache, Nginx, IIS, Tomcat\n- **Databases**: Oracle, MySQL, PostgreSQL, MSSQL\n- **Services**: DNS, SMTP, FTP, SSH, SNMP\n\n## Workflow\n\n### Step 1: Initial Configuration\n```bash\n# Start Nessus service\nsudo systemctl start nessusd\nsudo systemctl enable nessusd\n\n# CLI management with nessuscli\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli update --all\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli fix --list\n\n# Verify plugin count\n\u002Fopt\u002Fnessus\u002Fsbin\u002Fnessuscli update --plugins-only\n```\n\n### Step 2: Create Scan Policy\nConfigure a custom scan policy through the Nessus web UI at https:\u002F\u002Flocalhost:8834:\n\n1. Navigate to Policies > New Policy > Advanced Scan\n2. Configure General settings: name, description, targets\n3. Set Discovery settings:\n   - Host Discovery: Ping methods (ICMP, TCP SYN on ports 22,80,443)\n   - Port Scanning: SYN scan on common ports or all 65535 ports\n   - Service Discovery: Probe all ports for services\n4. Configure Assessment settings:\n   - Accuracy: Override normal accuracy (reduce false positives)\n   - Web Applications: Enable if scanning web servers\n5. Select Plugin families relevant to target environment\n\n### Step 3: Configure Credentials\nFor authenticated scanning, configure credentials under the Credentials tab:\n- **SSH**: Username\u002Fpassword or SSH key pair\n- **Windows**: Domain credentials via SMB, WMI\n- **SNMP**: Community strings (v1\u002Fv2c) or USM credentials (v3)\n- **Database**: Oracle, MySQL, PostgreSQL connection strings\n- **VMware**: vCenter or ESXi credentials\n\n### Step 4: Run the Scan\n```\n# Using Nessus REST API via curl\n# Authenticate and get token\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fsession \\\n  -d '{\"username\":\"admin\",\"password\":\"password\"}' \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Create scan\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fscans \\\n  -H \"X-Cookie: token=\u003CTOKEN>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"uuid\": \"\u003CTEMPLATE_UUID>\",\n    \"settings\": {\n      \"name\": \"Infrastructure Scan Q1\",\n      \"text_targets\": \"192.168.1.0\u002F24\",\n      \"enabled\": true,\n      \"launch\": \"ON_DEMAND\"\n    }\n  }'\n\n# Launch scan\ncurl -k -X POST https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID>\u002Flaunch \\\n  -H \"X-Cookie: token=\u003CTOKEN>\"\n\n# Check scan status\ncurl -k -X GET https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID> \\\n  -H \"X-Cookie: token=\u003CTOKEN>\"\n```\n\n### Step 5: Analyze Results\nNessus categorizes findings by severity:\n- **Critical (CVSS 9.0-10.0)**: Immediate remediation required\n- **High (CVSS 7.0-8.9)**: Remediate within 7-14 days\n- **Medium (CVSS 4.0-6.9)**: Remediate within 30 days\n- **Low (CVSS 0.1-3.9)**: Remediate during next maintenance window\n- **Informational**: No immediate action required\n\n### Step 6: Export and Report\n```bash\n# Export via REST API\ncurl -k -X POST \"https:\u002F\u002Flocalhost:8834\u002Fscans\u002F\u003CSCAN_ID>\u002Fexport\" \\\n  -H \"X-Cookie: token=\u003CTOKEN>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"format\":\"nessus\"}'\n\n# Supported formats: nessus (XML), csv, html, pdf\n```\n\n## Best Practices\n1. Schedule scans during maintenance windows to minimize production impact\n2. Use authenticated scanning for 45-60% more vulnerability detection\n3. Exclude fragile systems (medical devices, legacy SCADA) from aggressive scans\n4. Maintain separate scan policies for different network segments\n5. Update plugins before every scan to catch recently disclosed CVEs\n6. Validate critical findings manually before escalating to remediation teams\n7. Implement scan result trending to track remediation progress over time\n8. Store scan results in Tenable.sc or Tenable.io for centralized management\n\n## Common Pitfalls\n- Running unauthenticated scans only (misses 45-60% of vulnerabilities)\n- Scanning without written authorization (legal and ethical violations)\n- Ignoring scan performance impact on production systems\n- Failing to tune plugins leading to excessive false positives\n- Not validating scanner network connectivity before launching scans\n- Using default scan policies without customization for the environment\n\n## Related Skills\n- performing-authenticated-vulnerability-scan\n- prioritizing-vulnerabilities-with-cvss-scoring\n- implementing-continuous-vulnerability-monitoring\n- performing-network-vulnerability-assessment\n",{"name":5,"tags":43,"author":44,"domain":28,"license":15,"version":45,"nist_csf":46,"subdomain":31,"description":7,"mitre_attack":51},[31,29,25,34,37,32],"mahipal","1.0",[47,48,49,50],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[52,53,54,55],"T1190","T1203","T1068","T1046","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fscanning-infrastructure-with-nessus",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002FSKILL.md",true,[80,86,91,97,101,105,111],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"assets\u002Ftemplate.md","ASSET","资产文件",3695,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Fassets\u002Ftemplate.md",{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",1931,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1940,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fworkflows.md",4515,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Freferences\u002Fworkflows.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",6251,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Fscripts\u002Fagent.py",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fprocess.py",21306,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fscanning-infrastructure-with-nessus\u002Fscripts\u002Fprocess.py",[116,142,166,193,219,242],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":38},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,27,28,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":38},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,27,153,28,130,154,155,156,157,158,159,160,161,162,163,164,165],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":176,"publishedAt":38},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[172,175],{"categoryNo":173,"categoryName":174,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,177,178,179,180,28,24,181,154,182,183,184,185,186,187,188,189,190,191,192],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":38},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,28,204,205,206,207,208,209,210,211,212,213,214,215,157,216,217,218],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":38},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[225],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,28,230,231,232,31,233,25,234,235,236,237,32,35,238,239,240,241],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","qualys","openvas","cvss","remediation","api","prioritization","ssvc","decision-tree",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":38},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[248],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,250,28,251,252,253,254,255,256,257,258,188,259,189,260,261,262,263,264,265],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]