[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFPNXPF8RVQTHDHCKEV7RF":3,"skill-same:01M6AFPNXPF8RVQTHDHCKEV7RF":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AFPNXPF8RVQTHDHCKEV7RF","performing-cloud-native-threat-hunting-with-aws-detective",null,"Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise, or reconstructing an attacker's activity timeline across AWS accounts.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing cloud native threat hunting with aws detective","threat hunting","cloud native","cloud","aws","threat-hunting","vpc","t1078","guardduty","eks","iam","flow","incident-investigation","security","cloud-security","logs","audit","graph","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-cloud-native-threat-hunting-with-aws-detective\ndescription: Investigate AWS security incidents using Amazon Detective's behavior graphs,\n  built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity\n  timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral\n  movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise,\n  or reconstructing an attacker's activity timeline across AWS accounts.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- aws-detective\n- threat-hunting\n- cloud-security\n- guardduty\n- behavior-graph\n- aws\n- iam\n- ec2\n- incident-investigation\nversion: '1.0'\nauthor: juliosuas\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1071\n---\n\n# Performing Cloud-Native Threat Hunting with AWS Detective\n\n## Overview\n\nAWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.\n\n## Prerequisites\n\n- AWS account with Detective enabled (requires GuardDuty active for 48+ hours)\n- AWS CLI v2 configured with appropriate IAM permissions (`detective:*`, `guardduty:List*`)\n- Python 3.9+ with boto3\n- IAM policy: `AmazonDetectiveFullAccess` or custom policy with `detective:SearchGraph`, `detective:GetInvestigation`, `detective:ListIndicators`\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Behavior Graph** | Data structure linking CloudTrail, VPC Flow, GuardDuty, and EKS logs for an account\u002Fregion |\n| **Entity** | Investigable object: IAM user, IAM role, EC2 instance, IP address, S3 bucket, EKS cluster |\n| **Finding Group** | Correlated set of GuardDuty findings linked to the same attack campaign |\n| **Entity Profile** | Timeline of API calls, network connections, and resource access for a specific entity |\n| **Scope Time** | Investigation window (default 24h, max 1 year) for behavioral analysis |\n\n## Steps\n\n### Step 1: List Available Behavior Graphs\n\n```bash\naws detective list-graphs --output table\n```\n\n### Step 2: Investigate a Suspicious IAM User\n\n```bash\n# Get entity profile for an IAM user\naws detective get-investigation \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001\n```\n\n### Step 3: Search Entities Programmatically\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Search AWS Detective for suspicious entities.\"\"\"\nimport boto3\nimport json\nfrom datetime import datetime, timedelta\n\ndetective = boto3.client('detective')\n\ndef list_behavior_graphs():\n    \"\"\"List all Detective behavior graphs.\"\"\"\n    response = detective.list_graphs()\n    return response.get('GraphList', [])\n\ndef get_investigation_indicators(graph_arn, investigation_id, max_results=50):\n    \"\"\"Get indicators for a specific investigation.\"\"\"\n    response = detective.list_indicators(\n        GraphArn=graph_arn,\n        InvestigationId=investigation_id,\n        MaxResults=max_results\n    )\n    return response.get('Indicators', [])\n\ndef investigate_guardduty_findings(graph_arn):\n    \"\"\"List high-severity investigations correlated by Detective.\"\"\"\n    response = detective.list_investigations(\n        GraphArn=graph_arn,\n        FilterCriteria={\n            'Severity': {'Value': 'CRITICAL'},\n            'Status': {'Value': 'RUNNING'}\n        },\n        MaxResults=20\n    )\n\n    for investigation in response.get('InvestigationDetails', []):\n        print(f\"Investigation: {investigation['InvestigationId']}\")\n        print(f\"  Entity: {investigation['EntityArn']}\")\n        print(f\"  Status: {investigation['Status']}\")\n        print(f\"  Severity: {investigation['Severity']}\")\n        print(f\"  Created: {investigation['CreatedTime']}\")\n        print()\n\nif __name__ == \"__main__\":\n    graphs = list_behavior_graphs()\n    for graph in graphs:\n        print(f\"Graph: {graph['Arn']}\")\n        investigate_guardduty_findings(graph['Arn'])\n```\n\n### Step 4: Analyze Finding Groups for Attack Campaigns\n\n```bash\n# List investigations with high severity\naws detective list-investigations \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --filter-criteria '{\"Severity\":{\"Value\":\"HIGH\"}}' \\\n  --max-results 10\n```\n\n### Step 5: Check Entity Indicators\n\n```bash\n# Get indicators for a specific investigation\naws detective list-indicators \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001 \\\n  --max-results 50\n```\n\n## Expected Output\n\nThe `list-investigations` command returns investigation metadata:\n\n```json\n{\n  \"InvestigationDetails\": [\n    {\n      \"InvestigationId\": \"000000000000000000001\",\n      \"Severity\": \"CRITICAL\",\n      \"Status\": \"RUNNING\",\n      \"State\": \"ACTIVE\",\n      \"EntityArn\": \"arn:aws:iam::123456789012:user\u002Fsuspicious-user\",\n      \"EntityType\": \"IAM_USER\",\n      \"CreatedTime\": \"2026-03-15T14:30:00Z\"\n    }\n  ]\n}\n```\n\nIndicators are retrieved separately via `list-indicators` and include types such as `TTP_OBSERVED`, `IMPOSSIBLE_TRAVEL`, `FLAGGED_IP_ADDRESS`, `NEW_GEOLOCATION`, `NEW_ASO`, `NEW_USER_AGENT`, `RELATED_FINDING`, and `RELATED_FINDING_GROUP`.\n\n## Verification\n\n1. Confirm behavior graph has data: `aws detective list-graphs` returns non-empty list\n2. Validate investigation results contain entity timelines with API call sequences\n3. Cross-reference Detective findings with raw CloudTrail logs for accuracy\n4. Verify finding group correlations match manual investigation conclusions\n5. Confirm automated alerts trigger for HIGH\u002FCRITICAL severity investigations\n","# Performing Cloud-Native Threat Hunting with AWS Detective\n\n## Overview\n\nAWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.\n\n## Prerequisites\n\n- AWS account with Detective enabled (requires GuardDuty active for 48+ hours)\n- AWS CLI v2 configured with appropriate IAM permissions (`detective:*`, `guardduty:List*`)\n- Python 3.9+ with boto3\n- IAM policy: `AmazonDetectiveFullAccess` or custom policy with `detective:SearchGraph`, `detective:GetInvestigation`, `detective:ListIndicators`\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Behavior Graph** | Data structure linking CloudTrail, VPC Flow, GuardDuty, and EKS logs for an account\u002Fregion |\n| **Entity** | Investigable object: IAM user, IAM role, EC2 instance, IP address, S3 bucket, EKS cluster |\n| **Finding Group** | Correlated set of GuardDuty findings linked to the same attack campaign |\n| **Entity Profile** | Timeline of API calls, network connections, and resource access for a specific entity |\n| **Scope Time** | Investigation window (default 24h, max 1 year) for behavioral analysis |\n\n## Steps\n\n### Step 1: List Available Behavior Graphs\n\n```bash\naws detective list-graphs --output table\n```\n\n### Step 2: Investigate a Suspicious IAM User\n\n```bash\n# Get entity profile for an IAM user\naws detective get-investigation \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001\n```\n\n### Step 3: Search Entities Programmatically\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Search AWS Detective for suspicious entities.\"\"\"\nimport boto3\nimport json\nfrom datetime import datetime, timedelta\n\ndetective = boto3.client('detective')\n\ndef list_behavior_graphs():\n    \"\"\"List all Detective behavior graphs.\"\"\"\n    response = detective.list_graphs()\n    return response.get('GraphList', [])\n\ndef get_investigation_indicators(graph_arn, investigation_id, max_results=50):\n    \"\"\"Get indicators for a specific investigation.\"\"\"\n    response = detective.list_indicators(\n        GraphArn=graph_arn,\n        InvestigationId=investigation_id,\n        MaxResults=max_results\n    )\n    return response.get('Indicators', [])\n\ndef investigate_guardduty_findings(graph_arn):\n    \"\"\"List high-severity investigations correlated by Detective.\"\"\"\n    response = detective.list_investigations(\n        GraphArn=graph_arn,\n        FilterCriteria={\n            'Severity': {'Value': 'CRITICAL'},\n            'Status': {'Value': 'RUNNING'}\n        },\n        MaxResults=20\n    )\n\n    for investigation in response.get('InvestigationDetails', []):\n        print(f\"Investigation: {investigation['InvestigationId']}\")\n        print(f\"  Entity: {investigation['EntityArn']}\")\n        print(f\"  Status: {investigation['Status']}\")\n        print(f\"  Severity: {investigation['Severity']}\")\n        print(f\"  Created: {investigation['CreatedTime']}\")\n        print()\n\nif __name__ == \"__main__\":\n    graphs = list_behavior_graphs()\n    for graph in graphs:\n        print(f\"Graph: {graph['Arn']}\")\n        investigate_guardduty_findings(graph['Arn'])\n```\n\n### Step 4: Analyze Finding Groups for Attack Campaigns\n\n```bash\n# List investigations with high severity\naws detective list-investigations \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --filter-criteria '{\"Severity\":{\"Value\":\"HIGH\"}}' \\\n  --max-results 10\n```\n\n### Step 5: Check Entity Indicators\n\n```bash\n# Get indicators for a specific investigation\naws detective list-indicators \\\n  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \\\n  --investigation-id 000000000000000000001 \\\n  --max-results 50\n```\n\n## Expected Output\n\nThe `list-investigations` command returns investigation metadata:\n\n```json\n{\n  \"InvestigationDetails\": [\n    {\n      \"InvestigationId\": \"000000000000000000001\",\n      \"Severity\": \"CRITICAL\",\n      \"Status\": \"RUNNING\",\n      \"State\": \"ACTIVE\",\n      \"EntityArn\": \"arn:aws:iam::123456789012:user\u002Fsuspicious-user\",\n      \"EntityType\": \"IAM_USER\",\n      \"CreatedTime\": \"2026-03-15T14:30:00Z\"\n    }\n  ]\n}\n```\n\nIndicators are retrieved separately via `list-indicators` and include types such as `TTP_OBSERVED`, `IMPOSSIBLE_TRAVEL`, `FLAGGED_IP_ADDRESS`, `NEW_GEOLOCATION`, `NEW_ASO`, `NEW_USER_AGENT`, `RELATED_FINDING`, and `RELATED_FINDING_GROUP`.\n\n## Verification\n\n1. Confirm behavior graph has data: `aws detective list-graphs` returns non-empty list\n2. Validate investigation results contain entity timelines with API call sequences\n3. Cross-reference Detective findings with raw CloudTrail logs for accuracy\n4. Verify finding group correlations match manual investigation conclusions\n5. Confirm automated alerts trigger for HIGH\u002FCRITICAL severity investigations\n",{"name":5,"tags":44,"author":48,"domain":38,"license":15,"version":49,"nist_csf":50,"subdomain":33,"description":7,"mitre_attack":55},[45,24,33,27,46,23,29,47,31],"aws-detective","behavior-graph","ec2","juliosuas","1.0",[51,52,53,54],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[56,57,58,59,60],"T1078.004","T1530","T1537","T1580","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detective",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detective",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-native-threat-hunting-with-aws-detective","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002FSKILL.md",true,[85,91,97,101,105],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1116,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",8716,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1084,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fworkflows.md",1115,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Freferences\u002Fworkflows.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fprocess.py","SCRIPT","脚本",7027,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-native-threat-hunting-with-aws-detective\u002Fscripts\u002Fprocess.py",[112,141,165,192,217,244],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":123,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[118],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[124,125,126,127,32,38,128,129,37,130,131,132,133,134,135,136,137,138,139,140],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[147],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[149,137,150,151,32,152,38,37,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[159,176,177,178,179,38,180,181,153,182,183,184,185,186,187,26,188,189,190,191],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[198],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[200,201,202,38,203,204,34,205,206,207,208,209,210,211,212,213,156,214,215,216],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[225,226,227,38,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[32,252,38,253,254,255,256,257,258,259,260,26,261,188,262,263,264,265,266,267],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]