[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYB9PA60146QQBPSEX44FP":3,"skill-same:01M6GYB9PA60146QQBPSEX44FP":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M6GYB9PA60146QQBPSEX44FP","implementing-device-posture-assessment-in-zero-trust",null,"Implementing device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting resource access.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"implementing","assessment","ZeRO","zero trust","device","trust","implementing device posture assessment in zero trust","intune","Access Control","signals","access","jamf","cybersecurity","crowdstrike-zta","endpoint-compliance","CrowdStrike","endpoint","device-posture","zero-trust","architecture","2026-11-10 10:12:30",false,"---\nname: implementing-device-posture-assessment-in-zero-trust\ndescription: >\n  Implementing device posture assessment as a zero trust access control by integrating\n  endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into\n  conditional access policies that enforce compliance before granting resource access.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags: [device-posture, zero-trust, endpoint-compliance, crowdstrike-zta, intune, conditional-access, jamf]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n","# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n",{"name":5,"tags":48,"author":50,"domain":35,"license":14,"version":51,"subdomain":52,"description":53},[40,41,37,36,30,49,34],"conditional-access","mahipal","1.0","zero-trust-architecture","Implementing device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting resource access.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add micsapp\u002Fmicstec-skills --skill implementing-device-posture-assessment-in-zero-trust",{"tool":67,"command":68},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill implementing-device-posture-assessment-in-zero-trust",{"tool":70,"command":71},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill implementing-device-posture-assessment-in-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FSKILL.md",true,[75,81,86,92,96,100,106],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"assets\u002Ftemplate.md","ASSET","资产文件",4413,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fassets\u002Ftemplate.md",{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",1528,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fstandards.md",2232,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fstandards.md",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fworkflows.md",3307,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Freferences\u002Fworkflows.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",6830,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fprocess.py",12336,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-device-posture-assessment-in-zero-trust\u002Fscripts\u002Fprocess.py",[111,146,175,194,214,239],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":126,"publishedAt":43},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[118,123],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师",[42,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145],"azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":43},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[152,153,156,159],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},{"categoryNo":154,"categoryName":155,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":157,"categoryName":158,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},[161,162,163,164,127,165,166,167,168,169,170,171,135,136,142,172,173,143,174,23],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":182,"publishedAt":43},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[181],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[183,184,185,186,127,130,135,136,33,187,188,189,31,190,191,143,192,193,23,145],"policy","authoring","apim policy authoring","security","use","ready","api security","error","processing","cors configuration","production-ready",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":202,"publishedAt":43},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[200,201],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},{"categoryNo":124,"categoryName":125,"taxonomyType":20,"taxonomyTypeDesc":21},[203,186,204,135,189,205,127,161,206,207,208,209,136,210,143,211,212,213,144,145],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":43},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[221,222,223,163,224,225,226,227,135,228,229,230,231,232,233,234,235,236,237,238],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":115,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":245,"publishedAt":43},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[241,246,247,248,249,250,251,187,252,253],"npm","js","calculate","node","math","user","compute","errors"]