[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFSD40CJB8E3M6XG9JV9CS":3,"skill-same:01M6AFSD40CJB8E3M6XG9JV9CS":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AFSD40CJB8E3M6XG9JV9CS","performing-false-positive-reduction-in-siem",null,"Reduces SIEM false positives through systematic rule tuning, threshold adjustment, correlation logic refinement, allowlisting, and threat intelligence enrichment. Use when SOC analysts are overwhelmed by alert noise, when tuning noisy detection rules, or during a quarterly SIEM rule review to cut alert fatigue.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"performing false positive reduction in siem","siem","detection-engineering","alert-tuning","false-positive","tuning","alert-fatigue","t1566","t1078","detection","correlation","review","enrichment","soc","engineering","authentication","threat intelligence","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: performing-false-positive-reduction-in-siem\ndescription: Reduces SIEM false positives through systematic rule tuning, threshold\n  adjustment, correlation logic refinement, allowlisting, and threat intelligence\n  enrichment. Use when SOC analysts are overwhelmed by alert noise, when tuning noisy\n  detection rules, or during a quarterly SIEM rule review to cut alert fatigue.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- siem\n- false-positive\n- alert-tuning\n- detection-engineering\n- alert-fatigue\n- soc\n- correlation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Restore Access\n- Password Authentication\n- Reissue Credential\n- Strong Password Policy\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n---\n\n# Performing False Positive Reduction in SIEM\n\n## Overview\n\nFalse positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing false positive reduction in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with soc operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## False Positive Reduction Techniques\n\n### 1. Identify the Noisiest Rules\n\n```spl\n# Splunk - Top 10 noisiest correlation searches\nindex=notable\n| stats count by rule_name\n| sort -count\n| head 10\n| eval pct=round(count \u002F total * 100, 1)\n```\n\n```spl\n# False positive rate per rule\nindex=notable\n| stats count as total\n    count(eval(status_label=\"Closed - False Positive\")) as false_positives\n    count(eval(status_label=\"Closed - True Positive\")) as true_positives\n    by rule_name\n| eval fp_rate=round(false_positives \u002F total * 100, 1)\n| sort -fp_rate\n| where total > 10\n```\n\n### 2. Threshold Tuning\n\n```spl\n# Before: Too sensitive - fires on 5 failed logins\nindex=wineventlog EventCode=4625\n| stats count by src_ip\n| where count > 5\n\n# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes\nindex=wineventlog EventCode=4625\n| bin _time span=10m\n| stats count dc(TargetUserName) as unique_accounts by src_ip, _time\n| where count > 20 AND unique_accounts > 3\n```\n\n### 3. Allowlist\u002FExclusion Management\n\n```spl\n# Create allowlist lookup for known benign sources\n| inputlookup fp_allowlist.csv\n| fields src_ip, reason, approved_by, expiry_date\n\n# Apply allowlist in detection rule\nindex=wineventlog EventCode=4625\n| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason\n| where isnull(allowlisted_reason)\n| stats count dc(TargetUserName) as unique_accounts by src_ip\n| where count > 20 AND unique_accounts > 3\n```\n\n### 4. Correlation Enhancement\n\n```spl\n# Before: Single-event detection (noisy)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| eval severity=\"medium\"\n\n# After: Multi-signal correlation (precise)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| join src_ip type=left [\n    search index=wineventlog EventCode=4625\n    | stats count as failed_logins by src_ip\n]\n| join Computer type=left [\n    search index=sysmon EventCode=3\n    | stats dc(DestinationIp) as unique_external_connections by Computer\n    | where unique_external_connections > 10\n]\n| where isnotnull(failed_logins) OR unique_external_connections > 10\n| eval severity=case(\n    failed_logins > 10 AND unique_external_connections > 10, \"critical\",\n    failed_logins > 5 OR unique_external_connections > 5, \"high\",\n    true(), \"medium\"\n)\n```\n\n### 5. Time-Based Exclusions\n\n```spl\n# Exclude known maintenance windows\n| eval hour=strftime(_time, \"%H\")\n| eval day=strftime(_time, \"%A\")\n| where NOT (hour >= \"02\" AND hour \u003C= \"04\" AND day=\"Sunday\")\n\n# Exclude known batch job schedules\n| lookup scheduled_tasks_allowlist process_name, schedule_time\n    OUTPUT is_scheduled\n| where isnull(is_scheduled)\n```\n\n### 6. Behavioral Baseline Integration\n\n```spl\n# Build baseline for user login patterns\nindex=wineventlog EventCode=4624\n| bin _time span=1h\n| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time\n| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins\n    avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts\n    by TargetUserName\n| where logins > (avg_logins + 3 * stdev_logins)\n    OR unique_hosts > (avg_hosts + 3 * stdev_hosts)\n```\n\n### 7. Threat Intelligence Filtering\n\n```spl\n# Only alert when destination matches known threat intelligence\nindex=firewall action=allowed direction=outbound\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence\n| where isnotnull(threat_type) AND confidence > 70\n# This eliminates FPs from flagging connections to benign IPs\n```\n\n## Tuning Process Framework\n\n### Step 1: Identify (Weekly)\n- Pull top 10 rules by alert volume\n- Calculate FP rate for each\n- Identify rules with FP rate > 30%\n\n### Step 2: Analyze (Weekly)\n- Sample 20 false positives per rule\n- Categorize root cause of each FP\n- Identify common patterns\n\n### Step 3: Tune (Bi-weekly)\n- Adjust thresholds based on baseline data\n- Add allowlist entries for benign patterns\n- Enhance correlation logic\n- Add enrichment context\n\n### Step 4: Validate (Monthly)\n- Run Atomic Red Team tests to verify true positives still trigger\n- Calculate new FP rate after tuning\n- Document tuning rationale\n- Review with detection engineering team\n\n### Step 5: Report (Quarterly)\n- FP reduction metrics per rule\n- Overall alert volume trends\n- Analyst productivity improvements\n- Rules retired or replaced\n\n## Validation Testing\n\n```bash\n# Run Atomic Red Team test after tuning to confirm detection still works\n# Example: Test brute force detection after threshold adjustment\nInvoke-AtomicTest T1110.001 -TestNumbers 1\n```\n\n```spl\n# Verify detection still triggers after tuning\nindex=notable rule_name=\"Brute Force Detection\"\nearliest=-24h\n| stats count\n| where count > 0\n```\n\n## FP Reduction Metrics\n\n| Metric | Formula | Target |\n|---|---|---|\n| False Positive Rate | FP \u002F (FP + TP) * 100 | \u003C 20% |\n| Alert Volume Reduction | (Old Volume - New Volume) \u002F Old Volume * 100 | 30-50% per quarter |\n| Mean Triage Time | Total triage time \u002F Total alerts | \u003C 8 minutes |\n| Rule Precision | TP \u002F (TP + FP) | > 0.80 |\n| Analyst Satisfaction | Survey score | > 4\u002F5 |\n\n## References\n\n- [CyberSierra - Tune SIEM Alerts to Eliminate False Positives](https:\u002F\u002Fcybersierra.co\u002Fblog\u002Freduce-false-positives-siem\u002F)\n- [ConnectWise - 9 Ways to Eliminate SIEM False Positives](https:\u002F\u002Fwww.connectwise.com\u002Fblog\u002F9-ways-to-eliminate-siem-false-positives)\n- [Prophet Security - Alert Tuning Best Practices](https:\u002F\u002Fwww.prophetsecurity.ai\u002Fblog\u002Fsecurity-operations-center-soc-best-practices-alert-tuning)\n- [ManageEngine - Reducing SIEM Alert False Positives](https:\u002F\u002Fwww.manageengine.com\u002Flog-management\u002Fsiem\u002Freducing-siem-alert-false-positives.html)\n","# Performing False Positive Reduction in SIEM\n\n## Overview\n\nFalse positive alerts are non-malicious events that trigger security rules, overwhelming SOC analysts with noise. Studies show that up to 45% of SIEM alerts are false positives, and a typical SOC analyst can only investigate 20-25 alerts per shift effectively. Reducing false positives requires systematic tuning across thresholds, correlation logic, allowlists, enrichment, and continuous validation. SIEM rules should be reviewed on a quarterly cycle at minimum.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing false positive reduction in siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with soc operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## False Positive Reduction Techniques\n\n### 1. Identify the Noisiest Rules\n\n```spl\n# Splunk - Top 10 noisiest correlation searches\nindex=notable\n| stats count by rule_name\n| sort -count\n| head 10\n| eval pct=round(count \u002F total * 100, 1)\n```\n\n```spl\n# False positive rate per rule\nindex=notable\n| stats count as total\n    count(eval(status_label=\"Closed - False Positive\")) as false_positives\n    count(eval(status_label=\"Closed - True Positive\")) as true_positives\n    by rule_name\n| eval fp_rate=round(false_positives \u002F total * 100, 1)\n| sort -fp_rate\n| where total > 10\n```\n\n### 2. Threshold Tuning\n\n```spl\n# Before: Too sensitive - fires on 5 failed logins\nindex=wineventlog EventCode=4625\n| stats count by src_ip\n| where count > 5\n\n# After: Tuned - requires 20+ failures across 3+ accounts in 10 minutes\nindex=wineventlog EventCode=4625\n| bin _time span=10m\n| stats count dc(TargetUserName) as unique_accounts by src_ip, _time\n| where count > 20 AND unique_accounts > 3\n```\n\n### 3. Allowlist\u002FExclusion Management\n\n```spl\n# Create allowlist lookup for known benign sources\n| inputlookup fp_allowlist.csv\n| fields src_ip, reason, approved_by, expiry_date\n\n# Apply allowlist in detection rule\nindex=wineventlog EventCode=4625\n| lookup fp_allowlist src_ip OUTPUT reason as allowlisted_reason\n| where isnull(allowlisted_reason)\n| stats count dc(TargetUserName) as unique_accounts by src_ip\n| where count > 20 AND unique_accounts > 3\n```\n\n### 4. Correlation Enhancement\n\n```spl\n# Before: Single-event detection (noisy)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| eval severity=\"medium\"\n\n# After: Multi-signal correlation (precise)\nindex=wineventlog EventCode=4688 New_Process_Name=\"*powershell.exe\"\n| join src_ip type=left [\n    search index=wineventlog EventCode=4625\n    | stats count as failed_logins by src_ip\n]\n| join Computer type=left [\n    search index=sysmon EventCode=3\n    | stats dc(DestinationIp) as unique_external_connections by Computer\n    | where unique_external_connections > 10\n]\n| where isnotnull(failed_logins) OR unique_external_connections > 10\n| eval severity=case(\n    failed_logins > 10 AND unique_external_connections > 10, \"critical\",\n    failed_logins > 5 OR unique_external_connections > 5, \"high\",\n    true(), \"medium\"\n)\n```\n\n### 5. Time-Based Exclusions\n\n```spl\n# Exclude known maintenance windows\n| eval hour=strftime(_time, \"%H\")\n| eval day=strftime(_time, \"%A\")\n| where NOT (hour >= \"02\" AND hour \u003C= \"04\" AND day=\"Sunday\")\n\n# Exclude known batch job schedules\n| lookup scheduled_tasks_allowlist process_name, schedule_time\n    OUTPUT is_scheduled\n| where isnull(is_scheduled)\n```\n\n### 6. Behavioral Baseline Integration\n\n```spl\n# Build baseline for user login patterns\nindex=wineventlog EventCode=4624\n| bin _time span=1h\n| stats count as logins dc(Computer) as unique_hosts by TargetUserName, _time\n| eventstats avg(logins) as avg_logins stdev(logins) as stdev_logins\n    avg(unique_hosts) as avg_hosts stdev(unique_hosts) as stdev_hosts\n    by TargetUserName\n| where logins > (avg_logins + 3 * stdev_logins)\n    OR unique_hosts > (avg_hosts + 3 * stdev_hosts)\n```\n\n### 7. Threat Intelligence Filtering\n\n```spl\n# Only alert when destination matches known threat intelligence\nindex=firewall action=allowed direction=outbound\n| lookup ip_threat_intel_lookup ip as dest_ip OUTPUT threat_type, confidence\n| where isnotnull(threat_type) AND confidence > 70\n# This eliminates FPs from flagging connections to benign IPs\n```\n\n## Tuning Process Framework\n\n### Step 1: Identify (Weekly)\n- Pull top 10 rules by alert volume\n- Calculate FP rate for each\n- Identify rules with FP rate > 30%\n\n### Step 2: Analyze (Weekly)\n- Sample 20 false positives per rule\n- Categorize root cause of each FP\n- Identify common patterns\n\n### Step 3: Tune (Bi-weekly)\n- Adjust thresholds based on baseline data\n- Add allowlist entries for benign patterns\n- Enhance correlation logic\n- Add enrichment context\n\n### Step 4: Validate (Monthly)\n- Run Atomic Red Team tests to verify true positives still trigger\n- Calculate new FP rate after tuning\n- Document tuning rationale\n- Review with detection engineering team\n\n### Step 5: Report (Quarterly)\n- FP reduction metrics per rule\n- Overall alert volume trends\n- Analyst productivity improvements\n- Rules retired or replaced\n\n## Validation Testing\n\n```bash\n# Run Atomic Red Team test after tuning to confirm detection still works\n# Example: Test brute force detection after threshold adjustment\nInvoke-AtomicTest T1110.001 -TestNumbers 1\n```\n\n```spl\n# Verify detection still triggers after tuning\nindex=notable rule_name=\"Brute Force Detection\"\nearliest=-24h\n| stats count\n| where count > 0\n```\n\n## FP Reduction Metrics\n\n| Metric | Formula | Target |\n|---|---|---|\n| False Positive Rate | FP \u002F (FP + TP) * 100 | \u003C 20% |\n| Alert Volume Reduction | (Old Volume - New Volume) \u002F Old Volume * 100 | 30-50% per quarter |\n| Mean Triage Time | Total triage time \u002F Total alerts | \u003C 8 minutes |\n| Rule Precision | TP \u002F (TP + FP) | > 0.80 |\n| Analyst Satisfaction | Survey score | > 4\u002F5 |\n\n## References\n\n- [CyberSierra - Tune SIEM Alerts to Eliminate False Positives](https:\u002F\u002Fcybersierra.co\u002Fblog\u002Freduce-false-positives-siem\u002F)\n- [ConnectWise - 9 Ways to Eliminate SIEM False Positives](https:\u002F\u002Fwww.connectwise.com\u002Fblog\u002F9-ways-to-eliminate-siem-false-positives)\n- [Prophet Security - Alert Tuning Best Practices](https:\u002F\u002Fwww.prophetsecurity.ai\u002Fblog\u002Fsecurity-operations-center-soc-best-practices-alert-tuning)\n- [ManageEngine - Reducing SIEM Alert False Positives](https:\u002F\u002Fwww.manageengine.com\u002Flog-management\u002Fsiem\u002Freducing-siem-alert-false-positives.html)\n",{"name":5,"tags":48,"author":49,"domain":41,"license":15,"version":50,"nist_csf":51,"subdomain":56,"description":7,"mitre_attack":57,"d3fend_techniques":62},[25,28,27,26,30,37,34],"mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[58,59,60,61],"T1078","T1685.002","T1685.005","T1566",[63,64,65,66,67],"Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-false-positive-reduction-in-siem",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-false-positive-reduction-in-siem",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-false-positive-reduction-in-siem",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-false-positive-reduction-in-siem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",678,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1566,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",1069,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",629,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",5970,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",6190,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-false-positive-reduction-in-siem\u002Fscripts\u002Fprocess.py",[128,157,180,204,230,257],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":137,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[138,139,140,141,142,41,143,144,145,146,147,148,149,150,151,152,153,154,155,156],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[163],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[165,153,166,167,142,42,41,145,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":188,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[174,189,190,191,192,41,193,194,168,195,196,197,198,199,33,32,200,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,41,215,216,217,218,219,220,221,222,223,224,225,226,171,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,41,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[263],{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},[142,265,41,25,266,267,37,268,269,270,271,32,272,200,273,274,275,276,277,278],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]