[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AESEEKCFK7SGTG2NDTC02T":3,"skill-same:01M6AESEEKCFK7SGTG2NDTC02T":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M6AESEEKCFK7SGTG2NDTC02T","generating-threat-intelligence-reports",null,"Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002FSKILL.md",[18,23,26,31],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",{"categoryNo":32,"categoryName":33,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"generating threat intelligence reports","threat intelligence","cti","report-writing","PIR","TLP","intelligence-products","post-incident","NIST","data","NIST-CSF","writing","threat-intelligence","reporting","report","teams","security operations","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: generating-threat-intelligence-reports\ndescription: 'Generates structured cyber threat intelligence reports at strategic,\n  operational, and tactical levels tailored to specific audiences including executives,\n  security operations teams, and technical analysts. Use when producing finished intelligence\n  products from raw collection data, creating sector threat briefings, or delivering\n  post-incident intelligence assessments. Activates for requests involving CTI report\n  writing, threat briefings, intelligence products, finished intelligence, or executive\n  security reporting.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- CTI\n- threat-intelligence\n- intelligence-products\n- TLP\n- PIR\n- report-writing\n- NIST-CSF\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n---\n# Generating Threat Intelligence Reports\n\n## When to Use\n\nUse this skill when:\n- Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership\n- Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign)\n- Generating sector-specific threat briefings for executive decision-making on security investments\n\n**Do not use** this skill for raw IOC distribution — use TIP\u002FMISP for automated IOC sharing and reserve report generation for analyzed, finished intelligence.\n\n## Prerequisites\n\n- Completed analysis from collection and processing phase (PIRs partially or fully answered)\n- Audience profile: technical level, decision-making authority, information classification clearance\n- TLP classification decision for the product\n- Organization-specific reporting template aligned to audience expectations\n\n## Workflow\n\n### Step 1: Determine Report Type and Audience\n\nSelect the appropriate intelligence product type:\n\n**Strategic Intelligence Report**: For C-suite, board, risk committee\n- Content: Threat landscape trends, adversary intent vs. capability, risk to business objectives\n- Format: 1–3 pages, minimal jargon, business impact language, recommended decisions\n- Frequency: Monthly\u002FQuarterly\n\n**Operational Intelligence Report**: For CISO, security directors, IR leads\n- Content: Active campaigns, adversary TTPs, defensive recommendations, sector peer incidents\n- Format: 3–8 pages, moderate technical detail, mitigation priority list\n- Frequency: Weekly\n\n**Tactical Intelligence Bulletin**: For SOC analysts, threat hunters, vulnerability management\n- Content: Specific IOCs, YARA rules, Sigma detections, CVEs, patching guidance\n- Format: Structured tables, code blocks, 1–2 pages\n- Frequency: Daily or as-needed\n\n**Flash Report**: Urgent notification for imminent or active threats\n- Content: What is happening, immediate risk, what to do right now\n- Format: 1 page maximum, distributed within 2 hours of threat identification\n- Frequency: As-needed (zero-day, active campaign targeting sector)\n\n### Step 2: Structure Report Using Intelligence Standards\n\nApply intelligence writing standards from government and professional practice:\n\n**Headline\u002FKey Judgment**: Lead with the most important finding in plain language.\n- Bad: \"This report examines threat actor TTPs associated with Cl0p ransomware\"\n- Good: \"Cl0p ransomware group is actively exploiting CVE-2024-20353 in Cisco ASA devices to gain initial access; organizations using unpatched ASA appliances face imminent ransomware risk\"\n\n**Confidence Qualifiers** (use language from DNI ICD 203):\n- High confidence: \"assess with high confidence\" — strong evidence, few assumptions\n- Medium confidence: \"assess\" — credible sources but analytical assumptions required\n- Low confidence: \"suggests\" — limited sources, significant uncertainty\n\n**Evidence Attribution**: Cite sources using reference numbers [1], [2]; maintain source anonymization in TLP:AMBER\u002FRED products.\n\n### Step 3: Write Report Body\n\nUse structured format:\n\n**Executive Summary** (3–5 bullet points): Key findings, immediate business risk, top recommended action\n\n**Threat Overview**: Who is the adversary? What is their objective? Why does this matter to us?\n\n**Technical Analysis**: TTPs with ATT&CK technique IDs, IOCs, observed campaign behavior\n\n**Impact Assessment**: Potential operational, financial, reputational impact if attack succeeds\n\n**Recommended Actions**: Prioritized, time-bound defensive measures with owner assignment\n\n**Appendices**: Full IOC lists, YARA rules, Sigma detections, raw source references\n\n### Step 4: Apply TLP and Distribution Controls\n\nSelect TLP based on source sensitivity and sharing agreements:\n- **TLP:RED**: Named recipients only; cannot be shared outside briefing room\n- **TLP:AMBER+STRICT**: Organization only; no sharing with subsidiaries or partners\n- **TLP:AMBER**: Organization and trusted partners with need-to-know\n- **TLP:GREEN**: Community-wide sharing (ISAC members, sector peers)\n- **TLP:WHITE\u002FCLEAR**: Public distribution; no restrictions\n\nInclude TLP watermark on every page header and footer.\n\n### Step 5: Review and Quality Control\n\nBefore dissemination, apply these checks:\n- **Accuracy**: Are all facts sourced and cited? No unsubstantiated claims.\n- **Clarity**: Can the target audience understand this without additional context?\n- **Actionability**: Does every report section drive a decision or action?\n- **Classification**: Is TLP correctly applied? No source identification in AMBER\u002FRED products?\n- **Timeliness**: Is this intelligence still current? Events older than 48 hours require freshness assessment.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Finished Intelligence** | Analyzed, contextualized intelligence product ready for consumption by decision-makers; distinct from raw collected data |\n| **Key Judgment** | Primary analytical conclusion of a report; clearly stated in opening paragraph |\n| **TLP** | Traffic Light Protocol — FIRST-standard classification system for controlling intelligence sharing scope |\n| **ICD 203** | Intelligence Community Directive 203 — US government standard for analytic standards including confidence language |\n| **Flash Report** | Urgent, time-sensitive intelligence notification for imminent threats; prioritizes speed over depth |\n| **Intelligence Gap** | Area where collection is insufficient to answer a PIR; should be explicitly documented in reports |\n\n## Tools & Systems\n\n- **ThreatConnect Reports**: Built-in report templates with ATT&CK mapping, IOC tables, and stakeholder distribution controls\n- **Recorded Future**: Pre-built intelligence report templates with automated sourcing from proprietary datasets\n- **OpenCTI Reports**: STIX-based report objects with linked entities for structured finished intelligence\n- **Microsoft Word\u002FConfluence**: Common report delivery formats; use organization-approved templates with TLP headers\n\n## Common Pitfalls\n\n- **Writing for analysts instead of the audience**: Technical detail appropriate for SOC analysts overwhelms executives. Maintain strict audience segmentation.\n- **Omitting confidence levels**: Statements presented without confidence qualifiers appear as established facts when they may be low-confidence assessments.\n- **Intelligence without recommendations**: Reports that describe threats without prescribing actions leave stakeholders without direction.\n- **Stale intelligence**: Publishing a report on a threat campaign that was resolved 2 weeks ago creates alarm without utility. Include freshness dating on all claims.\n- **Over-classification**: Applying TLP:RED to information that could be TLP:GREEN impedes community sharing and limits defensive value across the sector.\n","# Generating Threat Intelligence Reports\n\n## When to Use\n\nUse this skill when:\n- Producing weekly, monthly, or quarterly threat intelligence summaries for security leadership\n- Creating a rapid intelligence assessment in response to a breaking threat (e.g., new zero-day, active ransomware campaign)\n- Generating sector-specific threat briefings for executive decision-making on security investments\n\n**Do not use** this skill for raw IOC distribution — use TIP\u002FMISP for automated IOC sharing and reserve report generation for analyzed, finished intelligence.\n\n## Prerequisites\n\n- Completed analysis from collection and processing phase (PIRs partially or fully answered)\n- Audience profile: technical level, decision-making authority, information classification clearance\n- TLP classification decision for the product\n- Organization-specific reporting template aligned to audience expectations\n\n## Workflow\n\n### Step 1: Determine Report Type and Audience\n\nSelect the appropriate intelligence product type:\n\n**Strategic Intelligence Report**: For C-suite, board, risk committee\n- Content: Threat landscape trends, adversary intent vs. capability, risk to business objectives\n- Format: 1–3 pages, minimal jargon, business impact language, recommended decisions\n- Frequency: Monthly\u002FQuarterly\n\n**Operational Intelligence Report**: For CISO, security directors, IR leads\n- Content: Active campaigns, adversary TTPs, defensive recommendations, sector peer incidents\n- Format: 3–8 pages, moderate technical detail, mitigation priority list\n- Frequency: Weekly\n\n**Tactical Intelligence Bulletin**: For SOC analysts, threat hunters, vulnerability management\n- Content: Specific IOCs, YARA rules, Sigma detections, CVEs, patching guidance\n- Format: Structured tables, code blocks, 1–2 pages\n- Frequency: Daily or as-needed\n\n**Flash Report**: Urgent notification for imminent or active threats\n- Content: What is happening, immediate risk, what to do right now\n- Format: 1 page maximum, distributed within 2 hours of threat identification\n- Frequency: As-needed (zero-day, active campaign targeting sector)\n\n### Step 2: Structure Report Using Intelligence Standards\n\nApply intelligence writing standards from government and professional practice:\n\n**Headline\u002FKey Judgment**: Lead with the most important finding in plain language.\n- Bad: \"This report examines threat actor TTPs associated with Cl0p ransomware\"\n- Good: \"Cl0p ransomware group is actively exploiting CVE-2024-20353 in Cisco ASA devices to gain initial access; organizations using unpatched ASA appliances face imminent ransomware risk\"\n\n**Confidence Qualifiers** (use language from DNI ICD 203):\n- High confidence: \"assess with high confidence\" — strong evidence, few assumptions\n- Medium confidence: \"assess\" — credible sources but analytical assumptions required\n- Low confidence: \"suggests\" — limited sources, significant uncertainty\n\n**Evidence Attribution**: Cite sources using reference numbers [1], [2]; maintain source anonymization in TLP:AMBER\u002FRED products.\n\n### Step 3: Write Report Body\n\nUse structured format:\n\n**Executive Summary** (3–5 bullet points): Key findings, immediate business risk, top recommended action\n\n**Threat Overview**: Who is the adversary? What is their objective? Why does this matter to us?\n\n**Technical Analysis**: TTPs with ATT&CK technique IDs, IOCs, observed campaign behavior\n\n**Impact Assessment**: Potential operational, financial, reputational impact if attack succeeds\n\n**Recommended Actions**: Prioritized, time-bound defensive measures with owner assignment\n\n**Appendices**: Full IOC lists, YARA rules, Sigma detections, raw source references\n\n### Step 4: Apply TLP and Distribution Controls\n\nSelect TLP based on source sensitivity and sharing agreements:\n- **TLP:RED**: Named recipients only; cannot be shared outside briefing room\n- **TLP:AMBER+STRICT**: Organization only; no sharing with subsidiaries or partners\n- **TLP:AMBER**: Organization and trusted partners with need-to-know\n- **TLP:GREEN**: Community-wide sharing (ISAC members, sector peers)\n- **TLP:WHITE\u002FCLEAR**: Public distribution; no restrictions\n\nInclude TLP watermark on every page header and footer.\n\n### Step 5: Review and Quality Control\n\nBefore dissemination, apply these checks:\n- **Accuracy**: Are all facts sourced and cited? No unsubstantiated claims.\n- **Clarity**: Can the target audience understand this without additional context?\n- **Actionability**: Does every report section drive a decision or action?\n- **Classification**: Is TLP correctly applied? No source identification in AMBER\u002FRED products?\n- **Timeliness**: Is this intelligence still current? Events older than 48 hours require freshness assessment.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Finished Intelligence** | Analyzed, contextualized intelligence product ready for consumption by decision-makers; distinct from raw collected data |\n| **Key Judgment** | Primary analytical conclusion of a report; clearly stated in opening paragraph |\n| **TLP** | Traffic Light Protocol — FIRST-standard classification system for controlling intelligence sharing scope |\n| **ICD 203** | Intelligence Community Directive 203 — US government standard for analytic standards including confidence language |\n| **Flash Report** | Urgent, time-sensitive intelligence notification for imminent threats; prioritizes speed over depth |\n| **Intelligence Gap** | Area where collection is insufficient to answer a PIR; should be explicitly documented in reports |\n\n## Tools & Systems\n\n- **ThreatConnect Reports**: Built-in report templates with ATT&CK mapping, IOC tables, and stakeholder distribution controls\n- **Recorded Future**: Pre-built intelligence report templates with automated sourcing from proprietary datasets\n- **OpenCTI Reports**: STIX-based report objects with linked entities for structured finished intelligence\n- **Microsoft Word\u002FConfluence**: Common report delivery formats; use organization-approved templates with TLP headers\n\n## Common Pitfalls\n\n- **Writing for analysts instead of the audience**: Technical detail appropriate for SOC analysts overwhelms executives. Maintain strict audience segmentation.\n- **Omitting confidence levels**: Statements presented without confidence qualifiers appear as established facts when they may be low-confidence assessments.\n- **Intelligence without recommendations**: Reports that describe threats without prescribing actions leave stakeholders without direction.\n- **Stale intelligence**: Publishing a report on a threat campaign that was resolved 2 weeks ago creates alarm without utility. Include freshness dating on all claims.\n- **Over-classification**: Applying TLP:RED to information that could be TLP:GREEN impedes community sharing and limits defensive value across the sector.\n",{"name":5,"tags":59,"author":61,"domain":52,"license":15,"version":62,"nist_csf":63,"subdomain":47,"description":68,"mitre_attack":69},[60,47,41,40,39,38,45],"CTI","team-cybersecurity","1.0.0",[64,65,66,67],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.\n",[70,71,72,73],"T1591","T1592","T1593","T1589","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fgenerating-threat-intelligence-reports",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-threat-intelligence-reports",{"tool":90,"command":91},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-threat-intelligence-reports",{"tool":93,"command":94},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-threat-intelligence-reports","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002FSKILL.md",true,[98,103,109],{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",2865,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fagent.py","SCRIPT","脚本",8897,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-threat-intelligence-reports\u002Fscripts\u002Fagent.py",[116,142,166,194,219,246],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":54},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[122],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,53,52,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":54},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,53,153,52,130,154,155,156,157,158,159,160,161,162,163,164,165],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":176,"publishedAt":54},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[172,175],{"categoryNo":173,"categoryName":174,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[160,177,178,179,180,52,181,182,154,183,184,185,186,187,188,189,190,191,192,193],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":54},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[200],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,52,205,206,207,208,209,210,211,44,212,213,214,215,157,216,217,218],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":54},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[225],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,52,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":247,"name":248,"nameZh":6,"description":249,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":250,"categories":251,"keywords":253,"publishedAt":54},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[252],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[53,254,52,255,256,257,258,259,43,260,261,189,262,190,263,264,265,266,267,268],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]