[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:pro6":8,"skills:sce6":55,"skills:creators9":100,"skills:all:stars:122:":195},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196836,11,7,1925,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",1,13273,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7774,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4987,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",39450,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13568,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6285,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],{"records":101,"total":7,"current":16,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,829295,"2026-11-14 03:52:46",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437710,"2026-11-14 03:02:00",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,343687,"2026-11-14 03:12:46",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",419,75,8,298187,"2026-11-14 03:13:01",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",528,48,243019,"2026-11-14 03:03:50",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238680,"2026-11-14 03:13:39",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188019,"2026-11-14 03:13:09",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174700,"2026-11-14 02:22:54",9,{"records":196,"total":4,"current":588,"size":589},[197,239,270,293,317,334,358,375,397,419,441,462,477,493,512,534,555,573],{"skillNo":198,"name":199,"nameZh":18,"description":200,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":209,"categories":210,"keywords":217,"publishedAt":238},"01M6ADZCB66Q698SCYXJWWD8FR","building-phishing-reporting-button-workflow","Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4\u002FCofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters. Use when deploying user-reported phishing intake or automating triage of the resulting reporting mailbox.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-phishing-reporting-button-workflow\u002FSKILL.md",[211,214],{"categoryNo":212,"categoryName":213,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发",[218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"workflow","reporting","phishing","building phishing reporting button workflow","security","cybersecurity","soar","implement","pr","development","create","intake","website","actions","email","email-security","awareness","phishing-reporting","security-awareness","microsoft-365","2026-11-10 10:12:30",{"skillNo":240,"name":241,"nameZh":18,"description":242,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":243,"categories":244,"keywords":252,"publishedAt":238},"01M6ADZ8EMFYYSPPJQR0RDTR74","building-patch-tuesday-response-process","Establish a repeatable operational process for triaging, testing, and deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL Server, Azure) via WSUS\u002FSCCM within risk-based remediation SLAs, from advisory review through validation. Use when building or improving a monthly patch management workflow or prioritizing which CVEs to remediate first.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-patch-tuesday-response-process\u002FSKILL.md",[245,248,251],{"categoryNo":246,"categoryName":247,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":249,"categoryName":250,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[253,254,255,223,218,104,256,257,258,259,260,261,262,263,264,265,266,267,268,269],"building patch tuesday response process","testing","review","windows","sql","sql server","azure","update","validation","server","office","patch-management","patch-tuesday","wsus","sccm","vulnerability-remediation","windows-update",{"skillNo":271,"name":272,"nameZh":18,"description":273,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":274,"categories":275,"keywords":277,"publishedAt":238},"01M6ADZ4T9F4DX5KBQWS13BXEN","building-malware-incident-communication-template","Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, technical advisories for IT teams, customer notifications, and regulatory disclosures, with severity-based escalation procedures. Use when drafting or standardizing incident communications and notification workflows for a malware outbreak.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-malware-incident-communication-template\u002FSKILL.md",[276],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[278,279,280,223,281,282,283,284,285,286,287,288,289,290,291,292],"communication","malware","building malware incident communication template","customer","workflows","teams","notifications","incident-response","ransomware","incident-communication","malware-response","stakeholder-notification","crisis-communication","executive-briefing","regulatory-disclosure",{"skillNo":294,"name":295,"nameZh":18,"description":296,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":297,"categories":298,"keywords":303,"publishedAt":238},"01M6ADZ1G2YQ748VHHNAGQFYQ2","building-ioc-enrichment-pipeline-with-opencti","Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native threat intel platform) using its internal enrichment connectors to pull context from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known actors\u002Fcampaigns, and score them for analyst prioritization. Use when deploying OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-ioc-enrichment-pipeline-with-opencti\u002FSKILL.md",[299,302],{"categoryNo":300,"categoryName":301,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[304,305,306,307,223,308,309,310,311,312,313,314,315,316],"ioc","enrichment","pipeline","building ioc enrichment pipeline with opencti","connectors","pull","mitre-attack","threat-intelligence","cti","stix","VirusTotal","AbuseIPDB","opencti",{"skillNo":318,"name":319,"nameZh":18,"description":320,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":321,"categories":322,"keywords":324,"publishedAt":238},"01M6ADYY5V4M6CF0887J3FJ246","building-ioc-defanging-and-sharing-pipeline","Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, emails), normalizes and deduplicates them, then produces defanged renderings for safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers, MISP, or email reports. Use when preparing indicators of compromise for safe analyst sharing or automating threat intel distribution to TAXII\u002FMISP feeds.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002FSKILL.md",[323],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[304,306,325,326,223,327,328,232,311,313,329,330,331,332,333],"building ioc defanging and sharing pipeline","safe","automation","distributed","MISP","TAXII","threat-sharing","defanging","indicator",{"skillNo":335,"name":336,"nameZh":18,"description":337,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":338,"categories":339,"keywords":341,"publishedAt":238},"01M6ADYTAXK061M9MV520JSBXK","building-incident-timeline-with-timesketch","Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation documentation. Use when reconstructing the sequence of events during an incident investigation or when multiple analysts need to jointly tag, annotate, and search a shared DFIR timeline.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-timeline-with-timesketch\u002FSKILL.md",[340],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[342,223,343,261,344,345,346,347,348,349,350,285,351,352,353,354,355,356,357],"building incident timeline with timesketch","documentation","search","content","metadata","file","forensics","incident-investigation","dfir","data","T1059.001","timeline-analysis","timesketch","forensic-timeline","plaso","collaborative-forensics",{"skillNo":359,"name":360,"nameZh":18,"description":361,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":362,"categories":363,"keywords":365,"publishedAt":238},"01M6ADYPJ2YR6ZSJ5NDK9Y3F3F","building-incident-response-playbook","Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision trees, escalation criteria, RACI matrices, and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use when creating or maturing an IR program, documenting response runbooks for a new incident type, or designing SOAR playbooks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-playbook\u002FSKILL.md",[364],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[366,367,223,224,368,369,285,370,371,372,373,374],"incident response","building incident response playbook","documents","integration","IR-playbook","runbook","NIST-800-61","SOAR-integration","response-procedures",{"skillNo":376,"name":377,"nameZh":18,"description":378,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":379,"categories":380,"keywords":386,"publishedAt":238},"01M6ADYK0VNTB7XFQPRFT20DH6","building-incident-response-dashboard","Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002FSKILL.md",[381,384,385],{"categoryNo":382,"categoryName":383,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},{"categoryNo":28,"categoryName":29,"taxonomyType":11,"taxonomyTypeDesc":12},[366,387,388,223,389,283,390,391,392,219,304,393,394,234,285,395,396],"dashboard","building incident response dashboard","status","visualization","metrics","grafana","soc","splunk","elastic","situational-awareness",{"skillNo":398,"name":399,"nameZh":18,"description":400,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":401,"categories":402,"keywords":404,"publishedAt":238},"01M6ADYFBKFPBBFJGQRQRG8VQ9","building-identity-governance-lifecycle-process","Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002FSKILL.md",[403],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[405,406,407,408,223,327,409,410,226,411,412,413,414,415,416,417,418],"identity","governance","building identity governance lifecycle process","design","entra id","rbac","compliance","gdpr","hipaa","identity-governance","lifecycle-management","JML","access-provisioning","IGA",{"skillNo":420,"name":421,"nameZh":18,"description":422,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":423,"categories":424,"keywords":426,"publishedAt":238},"01M6ADYBTWH36MBJMFM023SJJS","building-identity-federation-with-saml-azure-ad","Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002FSKILL.md",[425],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[405,259,427,428,223,104,429,430,431,409,226,432,433,434,435,436,437,438,439,440],"building identity federation with saml azure ad","directory","auth","sync","architecture","authentication","fs","entra-id","azure-ad","adfs","saml","federation","sso","hybrid-identity",{"skillNo":442,"name":443,"nameZh":18,"description":444,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":445,"categories":446,"keywords":447,"publishedAt":238},"01M6ADY87SZS11KQARXZMP6KFD","building-devsecops-pipeline-with-gitlab-ci","Configure a GitLab CI\u002FCD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-devsecops-pipeline-with-gitlab-ci\u002FSKILL.md",[],[448,449,450,306,451,452,222,223,226,453,454,455,456,457,458,459,460,461],"devsecops","gitlab","ci","building devsecops pipeline with gitlab ci","sast","deployment","vulnerability scanning","dependency scanning","gitlab-ci","dast","container-scanning","dependency-scanning","secret-detection","cicd-security",{"skillNo":463,"name":464,"nameZh":18,"description":465,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":466,"categories":467,"keywords":469,"publishedAt":238},"01M6ADY4VPKEFWS7JFPGN28BWG","building-detection-rules-with-sigma","Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-detection-rules-with-sigma\u002FSKILL.md",[468],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[470,223,471,472,473,104,310,393,394,352,474,475,395,476],"building detection rules with sigma","siem","threat intelligence","web","sigma","detection-rules","sentinel",{"skillNo":478,"name":479,"nameZh":18,"description":480,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":481,"categories":482,"keywords":484,"publishedAt":238},"01M6ADY16NM3E43W7BT40ESG00","building-detection-rule-with-splunk-spl","Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002FSKILL.md",[483],{"categoryNo":246,"categoryName":247,"taxonomyType":58,"taxonomyTypeDesc":59},[394,485,486,222,223,471,261,344,345,346,347,487,393,488,489,352,490,491,492],"SPL","building detection rule with splunk spl","engineering","threat-detection","Enterprise","detection-engineering","correlation-search","enterprise-security",{"skillNo":494,"name":495,"nameZh":18,"description":496,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":497,"categories":498,"keywords":500,"publishedAt":238},"01M6ADXXNGZNDNBGS4YXC3NH79","building-cloud-siem-with-sentinel","Deploy Microsoft Sentinel as a cloud-native SIEM\u002FSOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub\u002FGuardDuty suffice or for endpoint EDR needs.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002FSKILL.md",[499],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[471,501,502,503,223,224,504,327,308,259,226,505,506,393,488,507,508,509,510,511],"cloud","building cloud siem with sentinel","writing","threat hunting","kql","cloud-security","gcp","microsoft-sentinel","cloud-siem","kql-queries","soar-automation",{"skillNo":513,"name":514,"nameZh":18,"description":515,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":516,"categories":517,"keywords":519,"publishedAt":238},"01M6ADXT26CPNCPT2PBGERVVCG","building-c2-redirector-infrastructure","Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA\u002Fgeo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-redirector-infrastructure\u002FSKILL.md",[518],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[520,521,522,223,523,524,135,525,262,526,527,528,529,530,531,532,533],"infrastructure","c2","building c2 redirector infrastructure","triage","encrypt","proxy","red-team","nginx","malleable-c2","c2-infrastructure","redirector","apache-mod-rewrite","opsec","traffic-filtering",{"skillNo":535,"name":536,"nameZh":18,"description":537,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":538,"categories":539,"keywords":541,"publishedAt":238},"01M6ADXNYA8SJNV08Y16YJKGPW","building-c2-infrastructure-with-sliver-framework","Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP\u002FS, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon\u002Fsession implants that must survive blue-team detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-c2-infrastructure-with-sliver-framework\u002FSKILL.md",[540],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[520,542,521,543,223,544,545,261,546,347,547,262,526,548,549,550,551,552,553,554],"framework","building c2 infrastructure with sliver framework","support","http","protocol","operator","post-exploitation","beacon","command-and-control","dns","c2-framework","sliver","adversary-simulation",{"skillNo":556,"name":557,"nameZh":18,"description":558,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":559,"categories":560,"keywords":562,"publishedAt":238},"01M6ADXJZ404HPCNDE39Z57HVQ","building-automated-malware-submission-pipeline","Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-automated-malware-submission-pipeline\u002FSKILL.md",[561],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[279,563,564,565,223,471,327,566,283,567,568,369,232,569,570,393,314,571,572,306],"building automated malware submission pipeline","suspicious","sandbox","alert triage","run","gateways","malware analysis","malware-analysis","Cuckoo","any-run",{"skillNo":574,"name":575,"nameZh":18,"description":576,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":577,"categories":578,"keywords":580,"publishedAt":238},"01M6ADXFHKSNFSC6XSTH27BXXK","building-attack-pattern-library-from-cti-reports","Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma\u002FYARA templates from documented behaviors.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-attack-pattern-library-from-cti-reports\u002FSKILL.md",[579],{"categoryNo":215,"categoryName":216,"taxonomyType":58,"taxonomyTypeDesc":59},[581,312,582,583,584,223,472,104,261,546,347,487,310,311,313,585,352,586,587,490],"library","building attack pattern library from cti reports","nlp","python","yara","attack-pattern","cti-reports",122,18]