[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGCYCY9QW562V4CDK3X2RY":3,"skill-same:01M6AGCYCY9QW562V4CDK3X2RY":284},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AGCYCY9QW562V4CDK3X2RY","triaging-security-incident-with-ir-playbook",null,"Classifies and prioritizes security incidents using structured IR playbooks and SIEM\u002Fcase-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"playbook","triaging security incident with ir playbook","security","triage","teams","validation","soc","splunk","incident-response","siem","severity","t1078","t1490","tuning","thehive","classification","prioritization","severity-classification","cybersecurity","2026-11-10 10:12:30",false,"---\nname: triaging-security-incident-with-ir-playbook\ndescription: Classifies and prioritizes security incidents using structured IR\n  playbooks and SIEM\u002Fcase-management queries (Splunk, TheHive) to determine severity,\n  assign response teams, and initiate the appropriate response procedures. Use when\n  a new SOC alert needs triage, multiple concurrent incidents require prioritization,\n  or automated triage rules need validation or tuning.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-response\n- triage\n- playbook\n- severity-classification\n- soc\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Triaging Security Incidents with IR Playbooks\n\n## When to Use\n- New security alert received from SIEM, EDR, or other detection sources\n- SOC analyst needs to determine if an alert is a true positive requiring response\n- Incident needs severity classification and team assignment\n- Multiple concurrent incidents require prioritization\n- Automated triage rules need validation or tuning\n\n## Prerequisites\n- SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)\n- Incident response playbook library (by incident type)\n- Severity classification matrix approved by CISO\n- On-call rotation and escalation procedures\n- Ticketing system for incident tracking (ServiceNow, Jira, TheHive)\n- Threat intelligence feeds for IOC enrichment\n\n## Workflow\n\n### Step 1: Receive and Acknowledge Alert\n```bash\n# Query Splunk for new critical\u002Fhigh severity alerts\nindex=notable status=new severity IN (\"critical\",\"high\")\n| table _time, rule_name, src, dest, severity, description\n| sort -_time\n\n# Query TheHive for new cases\ncurl -s -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fquery?name=list-alerts\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":[{\"_name\":\"listAlert\"},{\"_name\":\"filter\",\"_field\":\"status\",\"_value\":\"New\"}]}'\n\n# Acknowledge alert in SIEM to prevent duplicate triage\ncurl -X POST \"https:\u002F\u002Fsplunk.local:8089\u002Fservices\u002Fnotable_update\" \\\n  -H \"Authorization: Bearer $SPLUNK_TOKEN\" \\\n  -d \"ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst\"\n```\n\n### Step 2: Enrich Alert Data\n```bash\n# Enrich source IP with VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$SRC_IP\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Check IP reputation with AbuseIPDB\ncurl -s \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck?ipAddress=$SRC_IP&maxAgeInDays=90\" \\\n  -H \"Key: $ABUSEIPDB_KEY\" -H \"Accept: application\u002Fjson\" | jq '.data'\n\n# Enrich file hash with threat intelligence\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$FILE_HASH\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Query internal asset database for affected systems\ncurl -s \"https:\u002F\u002Fcmdb.local\u002Fapi\u002Fassets?ip=$DEST_IP\" \\\n  -H \"Authorization: Bearer $CMDB_TOKEN\" | jq '.asset_criticality, .owner, .environment'\n```\n\n### Step 3: Classify Incident Type\n```bash\n# Map alert to incident category using playbook lookup\n# Categories: Malware, Phishing, Unauthorized Access, Data Exfiltration,\n# DoS\u002FDDoS, Insider Threat, Ransomware, Account Compromise, Web Attack\n\n# Check if alert matches known playbook trigger conditions\ngrep -i \"$ALERT_SIGNATURE\" \u002Fopt\u002Fir\u002Fplaybooks\u002Ftrigger_conditions.yaml\n\n# Determine incident type from MITRE ATT&CK technique\ncurl -s \"https:\u002F\u002Fattack.mitre.org\u002Fapi\u002Ftechniques\u002F$TECHNIQUE_ID\" | jq '.name, .tactic'\n```\n\n### Step 4: Assign Severity Level\n```bash\n# Severity matrix factors:\n# 1. Asset criticality (Critical\u002FHigh\u002FMedium\u002FLow)\n# 2. Data sensitivity (PII\u002FPHI\u002FPCI\u002FConfidential\u002FPublic)\n# 3. Number of affected systems\n# 4. Active vs historical threat\n# 5. Confirmed vs suspected compromise\n\n# Automated severity calculation\npython3 -c \"\nseverity_score = 0\n# Asset criticality: Critical=4, High=3, Medium=2, Low=1\nseverity_score += 4  # Critical server\n# Data sensitivity: PII\u002FPHI=4, PCI=3, Confidential=2, Public=1\nseverity_score += 3  # PCI data\n# Scope: Enterprise=4, Department=3, Single system=2, Single user=1\nseverity_score += 2  # Single system\n# Threat status: Active=4, Recent=3, Historical=2, Potential=1\nseverity_score += 4  # Active threat\n\nif severity_score >= 12: print('CRITICAL - P1')\nelif severity_score >= 9: print('HIGH - P2')\nelif severity_score >= 6: print('MEDIUM - P3')\nelse: print('LOW - P4')\nprint(f'Score: {severity_score}\u002F16')\n\"\n```\n\n### Step 5: Select and Initiate Playbook\n```bash\n# Load appropriate playbook based on incident type\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fransomware_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fphishing_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Funauthorized_access_playbook.yaml\n\n# Create incident ticket in TheHive\ncurl -X POST \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"title\": \"IR-2024-XXX: [Incident Type] - [Brief Description]\",\n    \"description\": \"Triage summary and initial findings\",\n    \"severity\": 3,\n    \"tlp\": 2,\n    \"pap\": 2,\n    \"tags\": [\"ransomware\", \"triage-complete\"],\n    \"customFields\": {\n      \"playbook\": {\"string\": \"ransomware_v2\"},\n      \"affected_systems\": {\"integer\": 5}\n    }\n  }'\n```\n\n### Step 6: Assign Response Team\n```bash\n# Check on-call schedule\ncurl -s \"https:\u002F\u002Fpagerduty.com\u002Fapi\u002Fv2\u002Foncalls?schedule_ids[]=$SCHEDULE_ID\" \\\n  -H \"Authorization: Token token=$PD_TOKEN\" | jq '.oncalls[].user.summary'\n\n# Page incident responders based on severity\n# P1\u002FCritical: Page IR lead + senior analysts + CISO\n# P2\u002FHigh: Page IR lead + available analysts\n# P3\u002FMedium: Assign to next available analyst\n# P4\u002FLow: Queue for business hours processing\n\ncurl -X POST \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"routing_key\": \"'$PD_ROUTING_KEY'\",\n    \"event_action\": \"trigger\",\n    \"payload\": {\n      \"summary\": \"P1 Security Incident: Ransomware detected on PROD-DB-01\",\n      \"severity\": \"critical\",\n      \"source\": \"SIEM-Splunk\",\n      \"custom_details\": {\"incident_id\": \"IR-2024-042\", \"playbook\": \"ransomware_v2\"}\n    }\n  }'\n```\n\n### Step 7: Document Triage Decision and Hand Off\n```bash\n# Update incident ticket with triage summary\ncurl -X PATCH \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"status\": \"InProgress\",\n    \"customFields\": {\n      \"triage_analyst\": {\"string\": \"analyst_name\"},\n      \"triage_time\": {\"date\": '$(date +%s000)'},\n      \"severity_justification\": {\"string\": \"Critical asset + active threat + PCI data\"}\n    }\n  }'\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| True Positive | Alert correctly identifying a real security incident |\n| False Positive | Alert incorrectly flagging benign activity as malicious |\n| Severity Classification | Ranking incident priority based on impact and urgency |\n| Playbook Selection | Choosing the appropriate response procedure based on incident type |\n| IOC Enrichment | Adding context to indicators from threat intelligence sources |\n| Escalation Threshold | Criteria triggering escalation to higher severity or management |\n| Triage SLA | Time target for initial assessment (typically 15-30 min for critical) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk\u002FElastic\u002FQRadar | SIEM alert correlation and querying |\n| TheHive\u002FSIRP | Incident case management and playbook tracking |\n| VirusTotal\u002FAbuseIPDB | IOC reputation and enrichment |\n| PagerDuty\u002FOpsGenie | On-call management and alerting |\n| MITRE ATT&CK | Technique classification and mapping |\n| Cortex XSOAR | SOAR platform for automated triage workflows |\n\n## Common Scenarios\n\n1. **Brute Force Alert**: Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.\n2. **Malware Detection on Endpoint**: AV\u002FEDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.\n3. **Suspicious Outbound Traffic**: Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.\n4. **Phishing Email Reported**: User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.\n5. **Privilege Escalation**: User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.\n\n## Output Format\n- Triage decision document with severity justification\n- Incident ticket with assigned playbook and team\n- IOC enrichment summary attached to case\n- Escalation notification to appropriate stakeholders\n- Initial timeline of events from alert data\n","# Triaging Security Incidents with IR Playbooks\n\n## When to Use\n- New security alert received from SIEM, EDR, or other detection sources\n- SOC analyst needs to determine if an alert is a true positive requiring response\n- Incident needs severity classification and team assignment\n- Multiple concurrent incidents require prioritization\n- Automated triage rules need validation or tuning\n\n## Prerequisites\n- SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)\n- Incident response playbook library (by incident type)\n- Severity classification matrix approved by CISO\n- On-call rotation and escalation procedures\n- Ticketing system for incident tracking (ServiceNow, Jira, TheHive)\n- Threat intelligence feeds for IOC enrichment\n\n## Workflow\n\n### Step 1: Receive and Acknowledge Alert\n```bash\n# Query Splunk for new critical\u002Fhigh severity alerts\nindex=notable status=new severity IN (\"critical\",\"high\")\n| table _time, rule_name, src, dest, severity, description\n| sort -_time\n\n# Query TheHive for new cases\ncurl -s -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fquery?name=list-alerts\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":[{\"_name\":\"listAlert\"},{\"_name\":\"filter\",\"_field\":\"status\",\"_value\":\"New\"}]}'\n\n# Acknowledge alert in SIEM to prevent duplicate triage\ncurl -X POST \"https:\u002F\u002Fsplunk.local:8089\u002Fservices\u002Fnotable_update\" \\\n  -H \"Authorization: Bearer $SPLUNK_TOKEN\" \\\n  -d \"ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst\"\n```\n\n### Step 2: Enrich Alert Data\n```bash\n# Enrich source IP with VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$SRC_IP\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Check IP reputation with AbuseIPDB\ncurl -s \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck?ipAddress=$SRC_IP&maxAgeInDays=90\" \\\n  -H \"Key: $ABUSEIPDB_KEY\" -H \"Accept: application\u002Fjson\" | jq '.data'\n\n# Enrich file hash with threat intelligence\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$FILE_HASH\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Query internal asset database for affected systems\ncurl -s \"https:\u002F\u002Fcmdb.local\u002Fapi\u002Fassets?ip=$DEST_IP\" \\\n  -H \"Authorization: Bearer $CMDB_TOKEN\" | jq '.asset_criticality, .owner, .environment'\n```\n\n### Step 3: Classify Incident Type\n```bash\n# Map alert to incident category using playbook lookup\n# Categories: Malware, Phishing, Unauthorized Access, Data Exfiltration,\n# DoS\u002FDDoS, Insider Threat, Ransomware, Account Compromise, Web Attack\n\n# Check if alert matches known playbook trigger conditions\ngrep -i \"$ALERT_SIGNATURE\" \u002Fopt\u002Fir\u002Fplaybooks\u002Ftrigger_conditions.yaml\n\n# Determine incident type from MITRE ATT&CK technique\ncurl -s \"https:\u002F\u002Fattack.mitre.org\u002Fapi\u002Ftechniques\u002F$TECHNIQUE_ID\" | jq '.name, .tactic'\n```\n\n### Step 4: Assign Severity Level\n```bash\n# Severity matrix factors:\n# 1. Asset criticality (Critical\u002FHigh\u002FMedium\u002FLow)\n# 2. Data sensitivity (PII\u002FPHI\u002FPCI\u002FConfidential\u002FPublic)\n# 3. Number of affected systems\n# 4. Active vs historical threat\n# 5. Confirmed vs suspected compromise\n\n# Automated severity calculation\npython3 -c \"\nseverity_score = 0\n# Asset criticality: Critical=4, High=3, Medium=2, Low=1\nseverity_score += 4  # Critical server\n# Data sensitivity: PII\u002FPHI=4, PCI=3, Confidential=2, Public=1\nseverity_score += 3  # PCI data\n# Scope: Enterprise=4, Department=3, Single system=2, Single user=1\nseverity_score += 2  # Single system\n# Threat status: Active=4, Recent=3, Historical=2, Potential=1\nseverity_score += 4  # Active threat\n\nif severity_score >= 12: print('CRITICAL - P1')\nelif severity_score >= 9: print('HIGH - P2')\nelif severity_score >= 6: print('MEDIUM - P3')\nelse: print('LOW - P4')\nprint(f'Score: {severity_score}\u002F16')\n\"\n```\n\n### Step 5: Select and Initiate Playbook\n```bash\n# Load appropriate playbook based on incident type\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fransomware_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fphishing_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Funauthorized_access_playbook.yaml\n\n# Create incident ticket in TheHive\ncurl -X POST \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"title\": \"IR-2024-XXX: [Incident Type] - [Brief Description]\",\n    \"description\": \"Triage summary and initial findings\",\n    \"severity\": 3,\n    \"tlp\": 2,\n    \"pap\": 2,\n    \"tags\": [\"ransomware\", \"triage-complete\"],\n    \"customFields\": {\n      \"playbook\": {\"string\": \"ransomware_v2\"},\n      \"affected_systems\": {\"integer\": 5}\n    }\n  }'\n```\n\n### Step 6: Assign Response Team\n```bash\n# Check on-call schedule\ncurl -s \"https:\u002F\u002Fpagerduty.com\u002Fapi\u002Fv2\u002Foncalls?schedule_ids[]=$SCHEDULE_ID\" \\\n  -H \"Authorization: Token token=$PD_TOKEN\" | jq '.oncalls[].user.summary'\n\n# Page incident responders based on severity\n# P1\u002FCritical: Page IR lead + senior analysts + CISO\n# P2\u002FHigh: Page IR lead + available analysts\n# P3\u002FMedium: Assign to next available analyst\n# P4\u002FLow: Queue for business hours processing\n\ncurl -X POST \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"routing_key\": \"'$PD_ROUTING_KEY'\",\n    \"event_action\": \"trigger\",\n    \"payload\": {\n      \"summary\": \"P1 Security Incident: Ransomware detected on PROD-DB-01\",\n      \"severity\": \"critical\",\n      \"source\": \"SIEM-Splunk\",\n      \"custom_details\": {\"incident_id\": \"IR-2024-042\", \"playbook\": \"ransomware_v2\"}\n    }\n  }'\n```\n\n### Step 7: Document Triage Decision and Hand Off\n```bash\n# Update incident ticket with triage summary\ncurl -X PATCH \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"status\": \"InProgress\",\n    \"customFields\": {\n      \"triage_analyst\": {\"string\": \"analyst_name\"},\n      \"triage_time\": {\"date\": '$(date +%s000)'},\n      \"severity_justification\": {\"string\": \"Critical asset + active threat + PCI data\"}\n    }\n  }'\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| True Positive | Alert correctly identifying a real security incident |\n| False Positive | Alert incorrectly flagging benign activity as malicious |\n| Severity Classification | Ranking incident priority based on impact and urgency |\n| Playbook Selection | Choosing the appropriate response procedure based on incident type |\n| IOC Enrichment | Adding context to indicators from threat intelligence sources |\n| Escalation Threshold | Criteria triggering escalation to higher severity or management |\n| Triage SLA | Time target for initial assessment (typically 15-30 min for critical) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk\u002FElastic\u002FQRadar | SIEM alert correlation and querying |\n| TheHive\u002FSIRP | Incident case management and playbook tracking |\n| VirusTotal\u002FAbuseIPDB | IOC reputation and enrichment |\n| PagerDuty\u002FOpsGenie | On-call management and alerting |\n| MITRE ATT&CK | Technique classification and mapping |\n| Cortex XSOAR | SOAR platform for automated triage workflows |\n\n## Common Scenarios\n\n1. **Brute Force Alert**: Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.\n2. **Malware Detection on Endpoint**: AV\u002FEDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.\n3. **Suspicious Outbound Traffic**: Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.\n4. **Phishing Email Reported**: User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.\n5. **Privilege Escalation**: User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.\n\n## Output Format\n- Triage decision document with severity justification\n- Incident ticket with assigned playbook and team\n- IOC enrichment summary attached to case\n- Escalation notification to appropriate stakeholders\n- Initial timeline of events from alert data\n",{"name":5,"tags":48,"author":49,"domain":42,"license":15,"version":50,"nist_csf":51,"subdomain":32,"description":7,"mitre_attack":56},[32,27,24,41,30],"mahipal","1.0",[52,53,54,55],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01",[57,58,59,60],"T1486","T1490","T1070","T1078","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftriaging-security-incident-with-ir-playbook",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbook",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbook",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbook","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",true,[85,91,96,102,106,110,114,118,122,126,130,133,137,141,145,149,153,156,159,163,167,170,174,178,182,185,189,193,196,200,203,206,209,212,215,219,222,226,230,233,237,241,245,248,251,255,259,263,266,270,274,280],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",2921,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1963,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fbibliography.md",8051,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fbibliography.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fflow-framework.md",4896,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fflow-framework.md",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fflow-prompts.lock",6165,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fflow-prompts.lock",{"path":115,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fprompts\u002Ffind\u002Fcontent-planning-for-topical-relevance-prompt.md",2172,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Ffind\u002Fcontent-planning-for-topical-relevance-prompt.md",{"path":119,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fprompts\u002Ffind\u002Fcontent-prioritization-prompt.md",2124,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Ffind\u002Fcontent-prioritization-prompt.md",{"path":123,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fprompts\u002Ffind\u002Fkeyword-research-prompt.md",2106,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Ffind\u002Fkeyword-research-prompt.md",{"path":127,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fprompts\u002Ffind\u002Fkeyword-variations-for-topical-relevance-prompt.md",2178,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Ffind\u002Fkeyword-variations-for-topical-relevance-prompt.md",{"path":131,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":124,"sourceHtmlUrl":132},"references\u002Fprompts\u002Ffind\u002Fprompt-audience-avatar.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Ffind\u002Fprompt-audience-avatar.md",{"path":134,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fprompts\u002Fleverage\u002Fbacklink-competition-prompt.md",2130,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Fleverage\u002Fbacklink-competition-prompt.md",{"path":138,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":139,"sourceHtmlUrl":140},"references\u002Fprompts\u002Flocal\u002Fai-homepage-rewrite-prompt.md",2118,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fai-homepage-rewrite-prompt.md",{"path":142,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":143,"sourceHtmlUrl":144},"references\u002Fprompts\u002Flocal\u002Fclaude-deep-research-prompt.md",2127,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fclaude-deep-research-prompt.md",{"path":146,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":147,"sourceHtmlUrl":148},"references\u002Fprompts\u002Flocal\u002Fgbp-categories-prompt.md",2103,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fgbp-categories-prompt.md",{"path":150,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":151,"sourceHtmlUrl":152},"references\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-1.md",2133,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-1.md",{"path":154,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":151,"sourceHtmlUrl":155},"references\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-2.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-2.md",{"path":157,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":151,"sourceHtmlUrl":158},"references\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-3.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fgbp-description-claude-prompt-3.md",{"path":160,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":161,"sourceHtmlUrl":162},"references\u002Fprompts\u002Flocal\u002Fgbp-services-prompt.md",2097,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fgbp-services-prompt.md",{"path":164,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":165,"sourceHtmlUrl":166},"references\u002Fprompts\u002Flocal\u002Fprompt-generating-a-meta-description.md",2151,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fprompt-generating-a-meta-description.md",{"path":168,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":135,"sourceHtmlUrl":169},"references\u002Fprompts\u002Flocal\u002Fprompt-generating-a-title-tag.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fprompt-generating-a-title-tag.md",{"path":171,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":172,"sourceHtmlUrl":173},"references\u002Fprompts\u002Flocal\u002Fprompt-rewriting-existing-homepage.md",2145,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fprompt-rewriting-existing-homepage.md",{"path":175,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":176,"sourceHtmlUrl":177},"references\u002Fprompts\u002Flocal\u002Fprompt-rewriting-existing-service-page.md",2160,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Flocal\u002Fprompt-rewriting-existing-service-page.md",{"path":179,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":180,"sourceHtmlUrl":181},"references\u002Fprompts\u002Foptimize\u002Fai-detector-test-follow-up-prompt.md",2148,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fai-detector-test-follow-up-prompt.md",{"path":183,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":165,"sourceHtmlUrl":184},"references\u002Fprompts\u002Foptimize\u002Fai-supporting-pages-rewrite-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fai-supporting-pages-rewrite-prompt.md",{"path":186,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":187,"sourceHtmlUrl":188},"references\u002Fprompts\u002Foptimize\u002Fbasic-prompt.md",2085,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fbasic-prompt.md",{"path":190,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":191,"sourceHtmlUrl":192},"references\u002Fprompts\u002Foptimize\u002Fblog-post-outline-prompt.md",2121,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fblog-post-outline-prompt.md",{"path":194,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":191,"sourceHtmlUrl":195},"references\u002Fprompts\u002Foptimize\u002Fblog-post-writing-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fblog-post-writing-prompt.md",{"path":197,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":198,"sourceHtmlUrl":199},"references\u002Fprompts\u002Foptimize\u002Fclaude-prompt-1.md",2094,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fclaude-prompt-1.md",{"path":201,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":198,"sourceHtmlUrl":202},"references\u002Fprompts\u002Foptimize\u002Fclaude-prompt-2.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fclaude-prompt-2.md",{"path":204,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":161,"sourceHtmlUrl":205},"references\u002Fprompts\u002Foptimize\u002Fctr-audit-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fctr-audit-prompt.md",{"path":207,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":147,"sourceHtmlUrl":208},"references\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt-1.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt-1.md",{"path":210,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":147,"sourceHtmlUrl":211},"references\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt-2.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt-2.md",{"path":213,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":161,"sourceHtmlUrl":214},"references\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Ffollow-up-prompt.md",{"path":216,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":217,"sourceHtmlUrl":218},"references\u002Fprompts\u002Foptimize\u002Fpaa-question-rewording-prompt.md",2136,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fpaa-question-rewording-prompt.md",{"path":220,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":217,"sourceHtmlUrl":221},"references\u002Fprompts\u002Foptimize\u002Fprompt-core-30-content-audit.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fprompt-core-30-content-audit.md",{"path":223,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":224,"sourceHtmlUrl":225},"references\u002Fprompts\u002Foptimize\u002Fproperty-content-with-authority-audit-prompt.md",2181,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fproperty-content-with-authority-audit-prompt.md",{"path":227,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":228,"sourceHtmlUrl":229},"references\u002Fprompts\u002Foptimize\u002Freddit-claude-prompt.md",2109,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Freddit-claude-prompt.md",{"path":231,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":198,"sourceHtmlUrl":232},"references\u002Fprompts\u002Foptimize\u002Fschema-prompt-1.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fschema-prompt-1.md",{"path":234,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":235,"sourceHtmlUrl":236},"references\u002Fprompts\u002Foptimize\u002Fstep-1-the-chatgpt-discovery-prompt.md",2157,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fstep-1-the-chatgpt-discovery-prompt.md",{"path":238,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":239,"sourceHtmlUrl":240},"references\u002Fprompts\u002Foptimize\u002Fstep-2-the-follow-up-qualifying-prompt.md",2166,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fstep-2-the-follow-up-qualifying-prompt.md",{"path":242,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":243,"sourceHtmlUrl":244},"references\u002Fprompts\u002Foptimize\u002Ftechnical-audit-prompt.md",2115,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Ftechnical-audit-prompt.md",{"path":246,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":135,"sourceHtmlUrl":247},"references\u002Fprompts\u002Foptimize\u002Fvisibility-follow-up-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fvisibility-follow-up-prompt.md",{"path":249,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":161,"sourceHtmlUrl":250},"references\u002Fprompts\u002Foptimize\u002Fvisiblity-prompt.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Foptimize\u002Fvisiblity-prompt.md",{"path":252,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":253,"sourceHtmlUrl":254},"references\u002Fprompts\u002FREADME.md",4536,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002FREADME.md",{"path":256,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":257,"sourceHtmlUrl":258},"references\u002Fprompts\u002Fwin\u002Fbofu-page-brief-generator.md",2240,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Fwin\u002Fbofu-page-brief-generator.md",{"path":260,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":261,"sourceHtmlUrl":262},"references\u002Fprompts\u002Fwin\u002Fconversion-audit-prompt.md",2204,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Fwin\u002Fconversion-audit-prompt.md",{"path":264,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":151,"sourceHtmlUrl":265},"references\u002Fprompts\u002Fwin\u002Fdual-surface-content-scorecard.md","https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fopencode\u002Fskills\u002Fseo-flow\u002Freferences\u002Fprompts\u002Fwin\u002Fdual-surface-content-scorecard.md",{"path":267,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":268,"sourceHtmlUrl":269},"references\u002Fstandards.md",2361,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fstandards.md",{"path":271,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":272,"sourceHtmlUrl":273},"references\u002Fworkflows.md",4705,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fworkflows.md",{"path":275,"resourceType":276,"resourceTypeDesc":277,"sizeBytes":278,"sourceHtmlUrl":279},"scripts\u002Fagent.py","SCRIPT","脚本",8659,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fscripts\u002Fagent.py",{"path":281,"resourceType":276,"resourceTypeDesc":277,"sizeBytes":282,"sourceHtmlUrl":283},"scripts\u002Fprocess.py",15558,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fscripts\u002Fprocess.py",[285,311,335,359,385,411],{"skillNo":286,"name":287,"nameZh":6,"description":288,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":289,"categories":290,"keywords":292,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[291],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[293,294,295,296,26,42,297,298,299,300,301,302,303,304,305,306,307,308,309,310],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":312,"name":313,"nameZh":6,"description":314,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":315,"categories":316,"keywords":318,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[317],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[319,307,320,321,26,322,42,299,323,324,325,326,327,328,329,330,331,332,333,334],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":336,"name":337,"nameZh":6,"description":338,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":339,"categories":340,"keywords":345,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[341,344],{"categoryNo":342,"categoryName":343,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[329,346,347,348,349,42,350,29,323,351,352,32,353,354,355,35,36,356,357,358],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","ransomware","cryptocurrency","detection","immutable","disaster-recovery","restore-testing",{"skillNo":360,"name":361,"nameZh":6,"description":362,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":363,"categories":364,"keywords":366,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[365],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[367,368,369,42,370,371,372,373,374,375,376,377,378,379,380,381,326,382,383,384],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":386,"name":387,"nameZh":6,"description":388,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":389,"categories":390,"keywords":392,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[391],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[393,394,395,42,396,397,398,399,400,401,402,403,404,405,406,407,408,40,409,410],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","ssvc","decision-tree",{"skillNo":412,"name":413,"nameZh":6,"description":414,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":415,"categories":416,"keywords":418,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[417],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,419,42,33,420,421,30,422,423,34,424,35,425,36,426,39,41,427,428,429],"triaging security incident","file","ioc","NIST-800-61","NIST","edr","execution","analysis","incident-triage","SANS-PICERL","SOC-operations"]