[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE7G8V2736QSC2AERGSG9M":3,"skill-same:01M6AE7G8V2736QSC2AERGSG9M":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AE7G8V2736QSC2AERGSG9M","deploying-cloudflare-access-for-zero-trust",null,"Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor\u002Fthird-party access to specific applications.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36],"cloudflare","ZeRO","deploying cloudflare access for zero trust","cybersecurity","architecture","identity","pr","zero-trust","ztna","cloudflare-access","cloudflare-tunnel","warp","cloudflare-one","2026-11-10 10:12:30",false,"---\nname: deploying-cloudflare-access-for-zero-trust\ndescription: Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor\u002Fthird-party access to specific applications.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- cloudflare\n- cloudflare-access\n- zero-trust\n- cloudflare-tunnel\n- warp\n- ztna\n- cloudflare-one\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0051\n- AML.T0054\n- AML.T0056\nnist_ai_rmf:\n- MEASURE-2.7\n- MEASURE-2.5\n- GOVERN-6.1\n- MAP-5.1\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1133\n- T1078\n- T1190\n- T1021\n---\n\n# Deploying Cloudflare Access for Zero Trust\n\n## When to Use\n\n- When replacing VPN infrastructure with identity-aware application access using Cloudflare One\n- When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports\n- When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services\n- When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities\n- When securing contractor and third-party access to specific applications without full network access\n\n**Do not use** for applications requiring persistent UDP connections not supported by Cloudflare Tunnel, for environments requiring air-gapped or fully on-premises access control, or when regulatory requirements prohibit routing traffic through third-party cloud infrastructure.\n\n## Prerequisites\n\n- Cloudflare account with Zero Trust subscription (Free for up to 50 users, paid plans for larger teams)\n- Domain name managed by Cloudflare DNS (or ability to add CNAME records)\n- Linux, Windows, or macOS server to run `cloudflared` tunnel daemon\n- Identity provider: Okta, Microsoft Entra ID, Google Workspace, GitHub, or any SAML\u002FOIDC provider\n- Cloudflare WARP client for device-level enrollment (optional but recommended)\n\n## Workflow\n\n### Step 1: Create a Cloudflare Tunnel to Internal Applications\n\nInstall `cloudflared` and create a persistent tunnel to expose internal services.\n\n```bash\n# Install cloudflared on Ubuntu\u002FDebian\ncurl -L https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fcloudflared\u002Freleases\u002Flatest\u002Fdownload\u002Fcloudflared-linux-amd64.deb \\\n  -o cloudflared.deb\nsudo dpkg -i cloudflared.deb\n\n# Authenticate cloudflared with your Cloudflare account\ncloudflared tunnel login\n\n# Create a named tunnel\ncloudflared tunnel create internal-apps\n# Output: Created tunnel internal-apps with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n\n# Configure tunnel routes to internal applications\ncat > ~\u002F.cloudflared\u002Fconfig.yml \u003C\u003C 'EOF'\ntunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\ncredentials-file: \u002Fhome\u002Fadmin\u002F.cloudflared\u002Fxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json\n\ningress:\n  - hostname: wiki.company.com\n    service: http:\u002F\u002Flocalhost:8080\n  - hostname: git.company.com\n    service: http:\u002F\u002F10.1.1.50:3000\n  - hostname: grafana.company.com\n    service: http:\u002F\u002F10.1.1.60:3000\n  - hostname: ssh.company.com\n    service: ssh:\u002F\u002Flocalhost:22\n  - hostname: rdp.company.com\n    service: rdp:\u002F\u002F10.1.1.100:3389\n  # Catch-all rule (required)\n  - service: http_status:404\nEOF\n\n# Route DNS to the tunnel\ncloudflared tunnel route dns internal-apps wiki.company.com\ncloudflared tunnel route dns internal-apps git.company.com\ncloudflared tunnel route dns internal-apps grafana.company.com\n\n# Run tunnel as a systemd service\nsudo cloudflared service install\nsudo systemctl enable cloudflared\nsudo systemctl start cloudflared\n\n# Verify tunnel status\ncloudflared tunnel info internal-apps\n```\n\n### Step 2: Configure Identity Provider Integration\n\nSet up authentication with your organization's identity provider.\n\n```bash\n# Using Cloudflare API to configure Okta as IdP\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fidentity_providers\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Okta\",\n    \"type\": \"okta\",\n    \"config\": {\n      \"client_id\": \"OKTA_CLIENT_ID\",\n      \"client_secret\": \"OKTA_CLIENT_SECRET\",\n      \"okta_account\": \"company.okta.com\",\n      \"api_token\": \"OKTA_API_TOKEN\",\n      \"claims\": [\"email\", \"groups\", \"name\"],\n      \"email_claim_name\": \"email\"\n    }\n  }'\n\n# Configure Microsoft Entra ID as additional IdP\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fidentity_providers\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Microsoft Entra ID\",\n    \"type\": \"azureAD\",\n    \"config\": {\n      \"client_id\": \"AZURE_APP_CLIENT_ID\",\n      \"client_secret\": \"AZURE_APP_CLIENT_SECRET\",\n      \"directory_id\": \"AZURE_TENANT_ID\",\n      \"support_groups\": true,\n      \"claims\": [\"email\", \"groups\", \"name\"]\n    }\n  }'\n```\n\n### Step 3: Create Access Applications and Policies\n\nDefine Access applications with identity-aware policies for each internal service.\n\n```bash\n# Create Access application for internal wiki\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Internal Wiki\",\n    \"domain\": \"wiki.company.com\",\n    \"type\": \"self_hosted\",\n    \"session_duration\": \"8h\",\n    \"auto_redirect_to_identity\": true,\n    \"http_only_cookie_attribute\": true,\n    \"same_site_cookie_attribute\": \"lax\",\n    \"logo_url\": \"https:\u002F\u002Fcompany.com\u002Fwiki-logo.png\",\n    \"allowed_idps\": [\"OKTA_IDP_ID\", \"AZURE_IDP_ID\"]\n  }'\n\n# Create Allow policy for the wiki application\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\u002F{app_id}\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Allow Engineering Team\",\n    \"decision\": \"allow\",\n    \"precedence\": 1,\n    \"include\": [\n      {\"group\": {\"id\": \"ENGINEERING_GROUP_ID\"}},\n      {\"okta\": {\"name\": \"Engineering\", \"identity_provider_id\": \"OKTA_IDP_ID\"}}\n    ],\n    \"require\": [\n      {\"device_posture\": {\"integration_uid\": \"CROWDSTRIKE_INTEGRATION_ID\"}}\n    ]\n  }'\n\n# Create Access application for SSH access\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"SSH Access\",\n    \"domain\": \"ssh.company.com\",\n    \"type\": \"ssh\",\n    \"session_duration\": \"4h\",\n    \"auto_redirect_to_identity\": true\n  }'\n```\n\n### Step 4: Deploy WARP Client for Device Enrollment\n\nEnroll corporate devices using Cloudflare WARP for private network access and device posture.\n\n```bash\n# Create device enrollment rule\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fpolicy\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Enrollment\",\n    \"match\": \"identity.email matches \\\".*@company\\\\.com$\\\"\",\n    \"precedence\": 100,\n    \"enabled\": true,\n    \"gateway_unique_id\": \"GATEWAY_ID\",\n    \"support_url\": \"https:\u002F\u002Fhelpdesk.company.com\u002Fwarp-help\"\n  }'\n\n# Install WARP on macOS via MDM (Jamf\u002FIntune)\n# Download: https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-devices\u002Fwarp\u002Fdownload-warp\u002F\n# Deploy with MDM configuration profile:\ncat > warp_mdm_config.plist \u003C\u003C 'EOF'\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE plist PUBLIC \"-\u002F\u002FApple\u002F\u002FDTD PLIST 1.0\u002F\u002FEN\" \"http:\u002F\u002Fwww.apple.com\u002FDTDs\u002FPropertyList-1.0.dtd\">\n\u003Cplist version=\"1.0\">\n\u003Cdict>\n    \u003Ckey>organization\u003C\u002Fkey>\n    \u003Cstring>company\u003C\u002Fstring>\n    \u003Ckey>auto_connect\u003C\u002Fkey>\n    \u003Cinteger>1\u003C\u002Finteger>\n    \u003Ckey>switch_locked\u003C\u002Fkey>\n    \u003Ctrue\u002F>\n    \u003Ckey>onboarding\u003C\u002Fkey>\n    \u003Cfalse\u002F>\n\u003C\u002Fdict>\n\u003C\u002Fplist>\nEOF\n\n# Install Cloudflare root certificate for TLS inspection\n# Download from: https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-devices\u002Fwarp\u002Fuser-side-certificates\u002F\nsudo cp cloudflare-root-ca.pem \u002Fusr\u002Flocal\u002Fshare\u002Fca-certificates\u002Fcloudflare-root-ca.crt\nsudo update-ca-certificates\n\n# Configure split tunnel to route private network through WARP\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fpolicy\u002F{policy_id}\u002Ffallback_domains\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '[\n    {\"suffix\": \"internal.corp\", \"description\": \"Internal corporate domain\"},\n    {\"suffix\": \"10.0.0.0\u002F8\", \"description\": \"Private network range\"}\n  ]'\n```\n\n### Step 5: Configure Device Posture Checks\n\nIntegrate endpoint security signals into Access policies.\n\n```bash\n# Add CrowdStrike device posture integration\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\u002Fintegration\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"CrowdStrike Falcon\",\n    \"type\": \"crowdstrike_s2s\",\n    \"config\": {\n      \"api_url\": \"https:\u002F\u002Fapi.crowdstrike.com\",\n      \"client_id\": \"CS_API_CLIENT_ID\",\n      \"client_secret\": \"CS_API_CLIENT_SECRET\",\n      \"customer_id\": \"CS_CUSTOMER_ID\"\n    },\n    \"interval\": \"10m\"\n  }'\n\n# Create device posture rule for disk encryption\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Disk Encryption Required\",\n    \"type\": \"disk_encryption\",\n    \"match\": [{\"platform\": \"windows\"}, {\"platform\": \"mac\"}],\n    \"input\": {\"requireAll\": true}\n  }'\n\n# Create device posture rule for OS version\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Minimum OS Version\",\n    \"type\": \"os_version\",\n    \"match\": [{\"platform\": \"windows\"}],\n    \"input\": {\"version\": \"10.0.19045\", \"operator\": \">=\"}\n  }'\n```\n\n### Step 6: Set Up Audit Logging and Analytics\n\nConfigure logging for access decisions and tunnel health monitoring.\n\n```bash\n# Enable Logpush for Access audit logs to S3\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Flogpush\u002Fjobs\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"access-audit-logs\",\n    \"output_options\": {\n      \"field_names\": [\"RayID\",\"Action\",\"Allowed\",\"AppDomain\",\"AppUUID\",\"Connection\",\"Country\",\"CreatedAt\",\"Email\",\"IPAddress\",\"PurposeJustificationPrompt\",\"PurposeJustificationResponse\",\"TemporaryAccessDuration\",\"UserUID\"],\n      \"timestamp_format\": \"rfc3339\"\n    },\n    \"destination_conf\": \"s3:\u002F\u002Fsecurity-logs-bucket\u002Fcloudflare-access\u002F?region=us-east-1&access-key-id=AKID&secret-access-key=SECRET\",\n    \"dataset\": \"access_requests\",\n    \"enabled\": true\n  }'\n\n# Query access logs via GraphQL Analytics API\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fgraphql\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"query\": \"{ viewer { accounts(filter: {accountTag: \\\"ACCOUNT_ID\\\"}) { accessLoginRequestsAdaptiveGroups(filter: {datetime_gt: \\\"2026-02-22T00:00:00Z\\\"}, limit: 100, orderBy: [count_DESC]) { dimensions { action appName userEmail country } count } } } }\"\n  }'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cloudflare Tunnel | Encrypted outbound-only connection from your infrastructure to Cloudflare's network, exposing internal services without opening inbound firewall ports |\n| Cloudflare Access | Identity-aware reverse proxy evaluating every request against access policies before granting access to protected applications |\n| WARP Client | Cloudflare's endpoint agent that routes device traffic through Cloudflare's network for policy enforcement and private network access |\n| Access Application | Configuration object defining a protected resource (self-hosted, SaaS, or infrastructure) with associated access policies |\n| Device Posture | Endpoint health signals (OS version, disk encryption, EDR status) evaluated as conditions in Access policies |\n| Cloudflare One | Unified SASE platform combining ZTNA (Access), SWG (Gateway), CASB, DLP, and RBI |\n\n## Tools & Systems\n\n- **Cloudflare Access**: Identity-aware application proxy providing per-request authorization\n- **Cloudflare Tunnel (cloudflared)**: Daemon creating encrypted tunnels from internal networks to Cloudflare edge\n- **WARP Client**: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing\n- **Cloudflare Gateway**: Secure Web Gateway providing DNS\u002FHTTP filtering and DLP inspection\n- **Cloudflare Logpush**: Real-time log streaming to external SIEM and storage destinations\n- **Access for Infrastructure**: SSH and RDP access with short-lived certificates and session recording\n\n## Common Scenarios\n\n### Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch\n\n**Context**: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.\n\n**Approach**:\n1. Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept\n2. Deploy one `cloudflared` tunnel on an EC2 instance in the production VPC\n3. Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing\n4. Configure Google Workspace as IdP for SSO authentication\n5. Create Access policies requiring @company.com email domain for all applications\n6. Add device posture checks for disk encryption and OS version\n7. Upgrade to paid plan and deploy WARP client to all employee laptops via MDM\n8. Enable Gateway DNS filtering and HTTP inspection for malware protection\n9. Configure Logpush to send access logs to Datadog for monitoring\n\n**Pitfalls**: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple `cloudflared` instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.\n\n## Output Format\n\n```\nCloudflare Zero Trust Deployment Report\n==================================================\nOrganization: StartupCorp\nTeam Name: startupcorp\nDeployment Date: 2026-02-23\n\nTUNNEL INFRASTRUCTURE:\n  Active Tunnels: 2 (primary + failover)\n  Tunnel Status: Healthy\n  Connected Edge: Washington DC, Ashburn\n  Ingress Routes: 8\n\nACCESS APPLICATIONS:\n  Self-Hosted Apps: 6\n  SaaS Apps: 3\n  SSH\u002FInfrastructure: 2\n  Total Policies: 15\n\nDEVICE ENROLLMENT:\n  Enrolled Devices: 187 \u002F 200\n  WARP Connected: 182 \u002F 187 (97.3%)\n  Posture Compliant: 175 \u002F 187 (93.6%)\n\nACCESS METRICS (last 30 days):\n  Total Requests: 89,432\n  Allowed: 88,756 (99.2%)\n  Blocked: 676 (0.8%)\n  Unique Users: 195\n  Countries: 12\n  Avg Session Duration: 6.2 hours\n```\n","# Deploying Cloudflare Access for Zero Trust\n\n## When to Use\n\n- When replacing VPN infrastructure with identity-aware application access using Cloudflare One\n- When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports\n- When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services\n- When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities\n- When securing contractor and third-party access to specific applications without full network access\n\n**Do not use** for applications requiring persistent UDP connections not supported by Cloudflare Tunnel, for environments requiring air-gapped or fully on-premises access control, or when regulatory requirements prohibit routing traffic through third-party cloud infrastructure.\n\n## Prerequisites\n\n- Cloudflare account with Zero Trust subscription (Free for up to 50 users, paid plans for larger teams)\n- Domain name managed by Cloudflare DNS (or ability to add CNAME records)\n- Linux, Windows, or macOS server to run `cloudflared` tunnel daemon\n- Identity provider: Okta, Microsoft Entra ID, Google Workspace, GitHub, or any SAML\u002FOIDC provider\n- Cloudflare WARP client for device-level enrollment (optional but recommended)\n\n## Workflow\n\n### Step 1: Create a Cloudflare Tunnel to Internal Applications\n\nInstall `cloudflared` and create a persistent tunnel to expose internal services.\n\n```bash\n# Install cloudflared on Ubuntu\u002FDebian\ncurl -L https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fcloudflared\u002Freleases\u002Flatest\u002Fdownload\u002Fcloudflared-linux-amd64.deb \\\n  -o cloudflared.deb\nsudo dpkg -i cloudflared.deb\n\n# Authenticate cloudflared with your Cloudflare account\ncloudflared tunnel login\n\n# Create a named tunnel\ncloudflared tunnel create internal-apps\n# Output: Created tunnel internal-apps with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n\n# Configure tunnel routes to internal applications\ncat > ~\u002F.cloudflared\u002Fconfig.yml \u003C\u003C 'EOF'\ntunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\ncredentials-file: \u002Fhome\u002Fadmin\u002F.cloudflared\u002Fxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json\n\ningress:\n  - hostname: wiki.company.com\n    service: http:\u002F\u002Flocalhost:8080\n  - hostname: git.company.com\n    service: http:\u002F\u002F10.1.1.50:3000\n  - hostname: grafana.company.com\n    service: http:\u002F\u002F10.1.1.60:3000\n  - hostname: ssh.company.com\n    service: ssh:\u002F\u002Flocalhost:22\n  - hostname: rdp.company.com\n    service: rdp:\u002F\u002F10.1.1.100:3389\n  # Catch-all rule (required)\n  - service: http_status:404\nEOF\n\n# Route DNS to the tunnel\ncloudflared tunnel route dns internal-apps wiki.company.com\ncloudflared tunnel route dns internal-apps git.company.com\ncloudflared tunnel route dns internal-apps grafana.company.com\n\n# Run tunnel as a systemd service\nsudo cloudflared service install\nsudo systemctl enable cloudflared\nsudo systemctl start cloudflared\n\n# Verify tunnel status\ncloudflared tunnel info internal-apps\n```\n\n### Step 2: Configure Identity Provider Integration\n\nSet up authentication with your organization's identity provider.\n\n```bash\n# Using Cloudflare API to configure Okta as IdP\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fidentity_providers\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Okta\",\n    \"type\": \"okta\",\n    \"config\": {\n      \"client_id\": \"OKTA_CLIENT_ID\",\n      \"client_secret\": \"OKTA_CLIENT_SECRET\",\n      \"okta_account\": \"company.okta.com\",\n      \"api_token\": \"OKTA_API_TOKEN\",\n      \"claims\": [\"email\", \"groups\", \"name\"],\n      \"email_claim_name\": \"email\"\n    }\n  }'\n\n# Configure Microsoft Entra ID as additional IdP\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fidentity_providers\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Microsoft Entra ID\",\n    \"type\": \"azureAD\",\n    \"config\": {\n      \"client_id\": \"AZURE_APP_CLIENT_ID\",\n      \"client_secret\": \"AZURE_APP_CLIENT_SECRET\",\n      \"directory_id\": \"AZURE_TENANT_ID\",\n      \"support_groups\": true,\n      \"claims\": [\"email\", \"groups\", \"name\"]\n    }\n  }'\n```\n\n### Step 3: Create Access Applications and Policies\n\nDefine Access applications with identity-aware policies for each internal service.\n\n```bash\n# Create Access application for internal wiki\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Internal Wiki\",\n    \"domain\": \"wiki.company.com\",\n    \"type\": \"self_hosted\",\n    \"session_duration\": \"8h\",\n    \"auto_redirect_to_identity\": true,\n    \"http_only_cookie_attribute\": true,\n    \"same_site_cookie_attribute\": \"lax\",\n    \"logo_url\": \"https:\u002F\u002Fcompany.com\u002Fwiki-logo.png\",\n    \"allowed_idps\": [\"OKTA_IDP_ID\", \"AZURE_IDP_ID\"]\n  }'\n\n# Create Allow policy for the wiki application\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\u002F{app_id}\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Allow Engineering Team\",\n    \"decision\": \"allow\",\n    \"precedence\": 1,\n    \"include\": [\n      {\"group\": {\"id\": \"ENGINEERING_GROUP_ID\"}},\n      {\"okta\": {\"name\": \"Engineering\", \"identity_provider_id\": \"OKTA_IDP_ID\"}}\n    ],\n    \"require\": [\n      {\"device_posture\": {\"integration_uid\": \"CROWDSTRIKE_INTEGRATION_ID\"}}\n    ]\n  }'\n\n# Create Access application for SSH access\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Faccess\u002Fapps\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"SSH Access\",\n    \"domain\": \"ssh.company.com\",\n    \"type\": \"ssh\",\n    \"session_duration\": \"4h\",\n    \"auto_redirect_to_identity\": true\n  }'\n```\n\n### Step 4: Deploy WARP Client for Device Enrollment\n\nEnroll corporate devices using Cloudflare WARP for private network access and device posture.\n\n```bash\n# Create device enrollment rule\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fpolicy\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Enrollment\",\n    \"match\": \"identity.email matches \\\".*@company\\\\.com$\\\"\",\n    \"precedence\": 100,\n    \"enabled\": true,\n    \"gateway_unique_id\": \"GATEWAY_ID\",\n    \"support_url\": \"https:\u002F\u002Fhelpdesk.company.com\u002Fwarp-help\"\n  }'\n\n# Install WARP on macOS via MDM (Jamf\u002FIntune)\n# Download: https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-devices\u002Fwarp\u002Fdownload-warp\u002F\n# Deploy with MDM configuration profile:\ncat > warp_mdm_config.plist \u003C\u003C 'EOF'\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE plist PUBLIC \"-\u002F\u002FApple\u002F\u002FDTD PLIST 1.0\u002F\u002FEN\" \"http:\u002F\u002Fwww.apple.com\u002FDTDs\u002FPropertyList-1.0.dtd\">\n\u003Cplist version=\"1.0\">\n\u003Cdict>\n    \u003Ckey>organization\u003C\u002Fkey>\n    \u003Cstring>company\u003C\u002Fstring>\n    \u003Ckey>auto_connect\u003C\u002Fkey>\n    \u003Cinteger>1\u003C\u002Finteger>\n    \u003Ckey>switch_locked\u003C\u002Fkey>\n    \u003Ctrue\u002F>\n    \u003Ckey>onboarding\u003C\u002Fkey>\n    \u003Cfalse\u002F>\n\u003C\u002Fdict>\n\u003C\u002Fplist>\nEOF\n\n# Install Cloudflare root certificate for TLS inspection\n# Download from: https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-devices\u002Fwarp\u002Fuser-side-certificates\u002F\nsudo cp cloudflare-root-ca.pem \u002Fusr\u002Flocal\u002Fshare\u002Fca-certificates\u002Fcloudflare-root-ca.crt\nsudo update-ca-certificates\n\n# Configure split tunnel to route private network through WARP\ncurl -X PUT \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fpolicy\u002F{policy_id}\u002Ffallback_domains\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '[\n    {\"suffix\": \"internal.corp\", \"description\": \"Internal corporate domain\"},\n    {\"suffix\": \"10.0.0.0\u002F8\", \"description\": \"Private network range\"}\n  ]'\n```\n\n### Step 5: Configure Device Posture Checks\n\nIntegrate endpoint security signals into Access policies.\n\n```bash\n# Add CrowdStrike device posture integration\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\u002Fintegration\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"CrowdStrike Falcon\",\n    \"type\": \"crowdstrike_s2s\",\n    \"config\": {\n      \"api_url\": \"https:\u002F\u002Fapi.crowdstrike.com\",\n      \"client_id\": \"CS_API_CLIENT_ID\",\n      \"client_secret\": \"CS_API_CLIENT_SECRET\",\n      \"customer_id\": \"CS_CUSTOMER_ID\"\n    },\n    \"interval\": \"10m\"\n  }'\n\n# Create device posture rule for disk encryption\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Disk Encryption Required\",\n    \"type\": \"disk_encryption\",\n    \"match\": [{\"platform\": \"windows\"}, {\"platform\": \"mac\"}],\n    \"input\": {\"requireAll\": true}\n  }'\n\n# Create device posture rule for OS version\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Fdevices\u002Fposture\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Minimum OS Version\",\n    \"type\": \"os_version\",\n    \"match\": [{\"platform\": \"windows\"}],\n    \"input\": {\"version\": \"10.0.19045\", \"operator\": \">=\"}\n  }'\n```\n\n### Step 6: Set Up Audit Logging and Analytics\n\nConfigure logging for access decisions and tunnel health monitoring.\n\n```bash\n# Enable Logpush for Access audit logs to S3\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Faccounts\u002F{account_id}\u002Flogpush\u002Fjobs\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"access-audit-logs\",\n    \"output_options\": {\n      \"field_names\": [\"RayID\",\"Action\",\"Allowed\",\"AppDomain\",\"AppUUID\",\"Connection\",\"Country\",\"CreatedAt\",\"Email\",\"IPAddress\",\"PurposeJustificationPrompt\",\"PurposeJustificationResponse\",\"TemporaryAccessDuration\",\"UserUID\"],\n      \"timestamp_format\": \"rfc3339\"\n    },\n    \"destination_conf\": \"s3:\u002F\u002Fsecurity-logs-bucket\u002Fcloudflare-access\u002F?region=us-east-1&access-key-id=AKID&secret-access-key=SECRET\",\n    \"dataset\": \"access_requests\",\n    \"enabled\": true\n  }'\n\n# Query access logs via GraphQL Analytics API\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fgraphql\" \\\n  -H \"Authorization: Bearer ${CF_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"query\": \"{ viewer { accounts(filter: {accountTag: \\\"ACCOUNT_ID\\\"}) { accessLoginRequestsAdaptiveGroups(filter: {datetime_gt: \\\"2026-02-22T00:00:00Z\\\"}, limit: 100, orderBy: [count_DESC]) { dimensions { action appName userEmail country } count } } } }\"\n  }'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cloudflare Tunnel | Encrypted outbound-only connection from your infrastructure to Cloudflare's network, exposing internal services without opening inbound firewall ports |\n| Cloudflare Access | Identity-aware reverse proxy evaluating every request against access policies before granting access to protected applications |\n| WARP Client | Cloudflare's endpoint agent that routes device traffic through Cloudflare's network for policy enforcement and private network access |\n| Access Application | Configuration object defining a protected resource (self-hosted, SaaS, or infrastructure) with associated access policies |\n| Device Posture | Endpoint health signals (OS version, disk encryption, EDR status) evaluated as conditions in Access policies |\n| Cloudflare One | Unified SASE platform combining ZTNA (Access), SWG (Gateway), CASB, DLP, and RBI |\n\n## Tools & Systems\n\n- **Cloudflare Access**: Identity-aware application proxy providing per-request authorization\n- **Cloudflare Tunnel (cloudflared)**: Daemon creating encrypted tunnels from internal networks to Cloudflare edge\n- **WARP Client**: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing\n- **Cloudflare Gateway**: Secure Web Gateway providing DNS\u002FHTTP filtering and DLP inspection\n- **Cloudflare Logpush**: Real-time log streaming to external SIEM and storage destinations\n- **Access for Infrastructure**: SSH and RDP access with short-lived certificates and session recording\n\n## Common Scenarios\n\n### Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch\n\n**Context**: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.\n\n**Approach**:\n1. Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept\n2. Deploy one `cloudflared` tunnel on an EC2 instance in the production VPC\n3. Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing\n4. Configure Google Workspace as IdP for SSO authentication\n5. Create Access policies requiring @company.com email domain for all applications\n6. Add device posture checks for disk encryption and OS version\n7. Upgrade to paid plan and deploy WARP client to all employee laptops via MDM\n8. Enable Gateway DNS filtering and HTTP inspection for malware protection\n9. Configure Logpush to send access logs to Datadog for monitoring\n\n**Pitfalls**: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple `cloudflared` instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.\n\n## Output Format\n\n```\nCloudflare Zero Trust Deployment Report\n==================================================\nOrganization: StartupCorp\nTeam Name: startupcorp\nDeployment Date: 2026-02-23\n\nTUNNEL INFRASTRUCTURE:\n  Active Tunnels: 2 (primary + failover)\n  Tunnel Status: Healthy\n  Connected Edge: Washington DC, Ashburn\n  Ingress Routes: 8\n\nACCESS APPLICATIONS:\n  Self-Hosted Apps: 6\n  SaaS Apps: 3\n  SSH\u002FInfrastructure: 2\n  Total Policies: 15\n\nDEVICE ENROLLMENT:\n  Enrolled Devices: 187 \u002F 200\n  WARP Connected: 182 \u002F 187 (97.3%)\n  Posture Compliant: 175 \u002F 187 (93.6%)\n\nACCESS METRICS (last 30 days):\n  Total Requests: 89,432\n  Allowed: 88,756 (99.2%)\n  Blocked: 676 (0.8%)\n  Unique Users: 195\n  Countries: 12\n  Avg Session Duration: 6.2 hours\n```\n",{"name":5,"tags":42,"author":43,"domain":27,"license":15,"version":44,"nist_csf":45,"subdomain":50,"description":7,"nist_ai_rmf":51,"mitre_attack":56,"atlas_techniques":61},[24,33,31,34,35,32,36],"mahipal","1.0",[46,47,48,49],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[52,53,54,55],"MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1",[57,58,59,60],"T1133","T1078","T1190","T1021",[62,63,64],"AML.T0051","AML.T0054","AML.T0056","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeploying-cloudflare-access-for-zero-trust",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-cloudflare-access-for-zero-trust",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-cloudflare-access-for-zero-trust",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-cloudflare-access-for-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",2036,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1390,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",1913,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",2725,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",3754,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",8653,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-cloudflare-access-for-zero-trust\u002Fscripts\u002Fprocess.py",[125,150,173,201,227,254],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":37},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135,136,137,27,138,29,30,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":37},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,137,161,27,30,162,25,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":37},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,27,188,189,162,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":37},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,27,212,213,214,215,216,217,218,219,220,221,222,223,164,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":37},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,27,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":37},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,262,27,263,264,265,266,267,268,269,270,196,271,197,272,273,274,275,276,277],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]