[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HM2GFJ394NKJZCTSFDHJ8F":3,"skill-same:01M6HM2GFJ394NKJZCTSFDHJ8F":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6HM2GFJ394NKJZCTSFDHJ8F","implementing-epss-score-for-vulnerability-prioritization",null,"Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30 days.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"prioritization","for","implementing","vulnerability","implementing epss score for vulnerability prioritization","epss","vulnerability-prioritization","risk","machine-learning","api","cybersecurity","learning","system","world","scoring","probability","id","machine","exploitation","vulnerability-management","2026-11-10 10:12:30",false,"---\nname: implementing-epss-score-for-vulnerability-prioritization\ndescription: Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30 days.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- epss\n- vulnerability-prioritization\n- first\n- exploit-prediction\n- cvss\n- risk-based\n- machine-learning\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\ncategory: implementing-epss-score-for-vulnerability-prioritization\n---\n# Implementing EPSS Score for Vulnerability Prioritization\n\n## Overview\n\nThe Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.\n\n\n## When to Use\n\n- When deploying or configuring implementing epss score for vulnerability prioritization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `matplotlib`\n- Access to FIRST EPSS API (https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss)\n- Vulnerability scan results with CVE identifiers\n- Optional: NVD API key for CVSS enrichment\n\n## EPSS API Usage\n\n### Query Single CVE\n```bash\n# Get EPSS score for a specific CVE\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400\" | python3 -m json.tool\n\n# Response:\n# {\n#   \"status\": \"OK\",\n#   \"status-code\": 200,\n#   \"version\": \"1.0\",\n#   \"total\": 1,\n#   \"data\": [\n#     {\n#       \"cve\": \"CVE-2024-3400\",\n#       \"epss\": \"0.95732\",\n#       \"percentile\": \"0.99721\",\n#       \"date\": \"2024-04-15\"\n#     }\n#   ]\n# }\n```\n\n### Query Multiple CVEs\n```bash\n# Batch query up to 100 CVEs\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400,CVE-2024-21887,CVE-2023-44228\" | \\\n  python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor item in data['data']:\n    pct = float(item['epss']) * 100\n    print(f\\\"{item['cve']}: {pct:.2f}% exploitation probability (percentile: {item['percentile']})\\\")\n\"\n```\n\n### Download Full EPSS Dataset\n```bash\n# Download complete daily EPSS scores (CSV format)\ncurl -s \"https:\u002F\u002Fepss.cyentia.com\u002Fepss_scores-current.csv.gz\" | gunzip > epss_scores_current.csv\n\n# Check size and preview\nwc -l epss_scores_current.csv\nhead -5 epss_scores_current.csv\n```\n\n### Query Historical EPSS Scores\n```bash\n# Get EPSS score for a specific date\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&date=2024-04-12\"\n\n# Get time series data\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&scope=time-series\"\n```\n\n## Prioritization Strategy\n\n### EPSS + CVSS Combined Approach\n\n| EPSS Score | CVSS Score | Priority | Action |\n|-----------|-----------|----------|--------|\n| > 0.7 | >= 9.0 | P0 - Immediate | Remediate within 24 hours |\n| > 0.7 | >= 7.0 | P1 - Urgent | Remediate within 48 hours |\n| > 0.4 | >= 7.0 | P2 - High | Remediate within 7 days |\n| > 0.1 | >= 4.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | >= 7.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | \u003C 7.0 | P4 - Low | Remediate within 90 days |\n\n### EPSS Percentile Thresholds\n- **Top 1% (percentile >= 0.99)**: Extremely likely to be exploited; treat as Critical\n- **Top 5% (percentile >= 0.95)**: High exploitation probability; prioritize remediation\n- **Top 10% (percentile >= 0.90)**: Elevated risk; schedule for near-term remediation\n- **Bottom 50%**: Low exploitation probability; handle in normal patch cycle\n\n## Implementation\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n\ndef fetch_epss_scores(cve_list):\n    \"\"\"Fetch EPSS scores for a list of CVEs from FIRST API.\"\"\"\n    scores = {}\n    batch_size = 100\n    for i in range(0, len(cve_list), batch_size):\n        batch = cve_list[i:i + batch_size]\n        resp = requests.get(\n            \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n            params={\"cve\": \",\".join(batch)},\n            timeout=30\n        )\n        if resp.status_code == 200:\n            for entry in resp.json().get(\"data\", []):\n                scores[entry[\"cve\"]] = {\n                    \"epss\": float(entry[\"epss\"]),\n                    \"percentile\": float(entry[\"percentile\"]),\n                    \"date\": entry.get(\"date\", \"\"),\n                }\n    return scores\n\ndef prioritize_vulnerabilities(scan_results_csv, output_csv):\n    \"\"\"Enrich scan results with EPSS scores and assign priorities.\"\"\"\n    df = pd.read_csv(scan_results_csv)\n    cve_list = df[\"cve_id\"].dropna().unique().tolist()\n\n    epss_data = fetch_epss_scores(cve_list)\n\n    df[\"epss_score\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"epss\", 0))\n    df[\"epss_percentile\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"percentile\", 0))\n\n    def assign_priority(row):\n        epss = row.get(\"epss_score\", 0)\n        cvss = row.get(\"cvss_score\", 0)\n        if epss > 0.7 and cvss >= 9.0:\n            return \"P0\"\n        if epss > 0.7 and cvss >= 7.0:\n            return \"P1\"\n        if epss > 0.4 and cvss >= 7.0:\n            return \"P2\"\n        if epss > 0.1 or cvss >= 7.0:\n            return \"P3\"\n        return \"P4\"\n\n    df[\"priority\"] = df.apply(assign_priority, axis=1)\n    df = df.sort_values([\"priority\", \"epss_score\"], ascending=[True, False])\n    df.to_csv(output_csv, index=False)\n    print(f\"[+] Prioritized {len(df)} vulnerabilities -> {output_csv}\")\n    print(f\"    P0: {len(df[df['priority']=='P0'])}\")\n    print(f\"    P1: {len(df[df['priority']=='P1'])}\")\n    print(f\"    P2: {len(df[df['priority']=='P2'])}\")\n    print(f\"    P3: {len(df[df['priority']=='P3'])}\")\n    print(f\"    P4: {len(df[df['priority']=='P4'])}\")\n    return df\n```\n\n## EPSS Trend Analysis\n\n```python\ndef fetch_epss_timeseries(cve_id):\n    \"\"\"Get historical EPSS scores for trend analysis.\"\"\"\n    resp = requests.get(\n        \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n        params={\"cve\": cve_id, \"scope\": \"time-series\"},\n        timeout=30\n    )\n    if resp.status_code == 200:\n        return resp.json().get(\"data\", [])\n    return []\n\ndef detect_epss_spikes(cve_id, threshold=0.3):\n    \"\"\"Detect significant EPSS score increases indicating emerging threats.\"\"\"\n    timeseries = fetch_epss_timeseries(cve_id)\n    if len(timeseries) \u003C 2:\n        return False\n    sorted_data = sorted(timeseries, key=lambda x: x.get(\"date\", \"\"))\n    latest = float(sorted_data[-1].get(\"epss\", 0))\n    previous = float(sorted_data[-2].get(\"epss\", 0))\n    increase = latest - previous\n    if increase >= threshold:\n        print(f\"[!] EPSS spike detected for {cve_id}: {previous:.3f} -> {latest:.3f} (+{increase:.3f})\")\n        return True\n    return False\n```\n\n## References\n\n- [FIRST EPSS Official](https:\u002F\u002Fwww.first.org\u002Fepss\u002F)\n- [EPSS API Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fapi)\n- [EPSS Model Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fmodel)\n- [EPSS Data Downloads](https:\u002F\u002Fepss.cyentia.com\u002F)\n- [Cyentia Institute Research](https:\u002F\u002Fwww.cyentia.com\u002Fepss\u002F)\n","# Implementing EPSS Score for Vulnerability Prioritization\n\n## Overview\n\nThe Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST (Forum of Incident Response and Security Teams) that estimates the probability of a CVE being exploited in the wild within the next 30 days. EPSS produces scores from 0.0 to 1.0 (0% to 100%) using machine learning trained on real-world exploitation data. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation, making it essential for risk-based vulnerability prioritization.\n\n\n## When to Use\n\n- When deploying or configuring implementing epss score for vulnerability prioritization capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `matplotlib`\n- Access to FIRST EPSS API (https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss)\n- Vulnerability scan results with CVE identifiers\n- Optional: NVD API key for CVSS enrichment\n\n## EPSS API Usage\n\n### Query Single CVE\n```bash\n# Get EPSS score for a specific CVE\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400\" | python3 -m json.tool\n\n# Response:\n# {\n#   \"status\": \"OK\",\n#   \"status-code\": 200,\n#   \"version\": \"1.0\",\n#   \"total\": 1,\n#   \"data\": [\n#     {\n#       \"cve\": \"CVE-2024-3400\",\n#       \"epss\": \"0.95732\",\n#       \"percentile\": \"0.99721\",\n#       \"date\": \"2024-04-15\"\n#     }\n#   ]\n# }\n```\n\n### Query Multiple CVEs\n```bash\n# Batch query up to 100 CVEs\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400,CVE-2024-21887,CVE-2023-44228\" | \\\n  python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor item in data['data']:\n    pct = float(item['epss']) * 100\n    print(f\\\"{item['cve']}: {pct:.2f}% exploitation probability (percentile: {item['percentile']})\\\")\n\"\n```\n\n### Download Full EPSS Dataset\n```bash\n# Download complete daily EPSS scores (CSV format)\ncurl -s \"https:\u002F\u002Fepss.cyentia.com\u002Fepss_scores-current.csv.gz\" | gunzip > epss_scores_current.csv\n\n# Check size and preview\nwc -l epss_scores_current.csv\nhead -5 epss_scores_current.csv\n```\n\n### Query Historical EPSS Scores\n```bash\n# Get EPSS score for a specific date\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&date=2024-04-12\"\n\n# Get time series data\ncurl -s \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve=CVE-2024-3400&scope=time-series\"\n```\n\n## Prioritization Strategy\n\n### EPSS + CVSS Combined Approach\n\n| EPSS Score | CVSS Score | Priority | Action |\n|-----------|-----------|----------|--------|\n| > 0.7 | >= 9.0 | P0 - Immediate | Remediate within 24 hours |\n| > 0.7 | >= 7.0 | P1 - Urgent | Remediate within 48 hours |\n| > 0.4 | >= 7.0 | P2 - High | Remediate within 7 days |\n| > 0.1 | >= 4.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | >= 7.0 | P3 - Medium | Remediate within 30 days |\n| \u003C= 0.1 | \u003C 7.0 | P4 - Low | Remediate within 90 days |\n\n### EPSS Percentile Thresholds\n- **Top 1% (percentile >= 0.99)**: Extremely likely to be exploited; treat as Critical\n- **Top 5% (percentile >= 0.95)**: High exploitation probability; prioritize remediation\n- **Top 10% (percentile >= 0.90)**: Elevated risk; schedule for near-term remediation\n- **Bottom 50%**: Low exploitation probability; handle in normal patch cycle\n\n## Implementation\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n\ndef fetch_epss_scores(cve_list):\n    \"\"\"Fetch EPSS scores for a list of CVEs from FIRST API.\"\"\"\n    scores = {}\n    batch_size = 100\n    for i in range(0, len(cve_list), batch_size):\n        batch = cve_list[i:i + batch_size]\n        resp = requests.get(\n            \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n            params={\"cve\": \",\".join(batch)},\n            timeout=30\n        )\n        if resp.status_code == 200:\n            for entry in resp.json().get(\"data\", []):\n                scores[entry[\"cve\"]] = {\n                    \"epss\": float(entry[\"epss\"]),\n                    \"percentile\": float(entry[\"percentile\"]),\n                    \"date\": entry.get(\"date\", \"\"),\n                }\n    return scores\n\ndef prioritize_vulnerabilities(scan_results_csv, output_csv):\n    \"\"\"Enrich scan results with EPSS scores and assign priorities.\"\"\"\n    df = pd.read_csv(scan_results_csv)\n    cve_list = df[\"cve_id\"].dropna().unique().tolist()\n\n    epss_data = fetch_epss_scores(cve_list)\n\n    df[\"epss_score\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"epss\", 0))\n    df[\"epss_percentile\"] = df[\"cve_id\"].map(lambda c: epss_data.get(c, {}).get(\"percentile\", 0))\n\n    def assign_priority(row):\n        epss = row.get(\"epss_score\", 0)\n        cvss = row.get(\"cvss_score\", 0)\n        if epss > 0.7 and cvss >= 9.0:\n            return \"P0\"\n        if epss > 0.7 and cvss >= 7.0:\n            return \"P1\"\n        if epss > 0.4 and cvss >= 7.0:\n            return \"P2\"\n        if epss > 0.1 or cvss >= 7.0:\n            return \"P3\"\n        return \"P4\"\n\n    df[\"priority\"] = df.apply(assign_priority, axis=1)\n    df = df.sort_values([\"priority\", \"epss_score\"], ascending=[True, False])\n    df.to_csv(output_csv, index=False)\n    print(f\"[+] Prioritized {len(df)} vulnerabilities -> {output_csv}\")\n    print(f\"    P0: {len(df[df['priority']=='P0'])}\")\n    print(f\"    P1: {len(df[df['priority']=='P1'])}\")\n    print(f\"    P2: {len(df[df['priority']=='P2'])}\")\n    print(f\"    P3: {len(df[df['priority']=='P3'])}\")\n    print(f\"    P4: {len(df[df['priority']=='P4'])}\")\n    return df\n```\n\n## EPSS Trend Analysis\n\n```python\ndef fetch_epss_timeseries(cve_id):\n    \"\"\"Get historical EPSS scores for trend analysis.\"\"\"\n    resp = requests.get(\n        \"https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss\",\n        params={\"cve\": cve_id, \"scope\": \"time-series\"},\n        timeout=30\n    )\n    if resp.status_code == 200:\n        return resp.json().get(\"data\", [])\n    return []\n\ndef detect_epss_spikes(cve_id, threshold=0.3):\n    \"\"\"Detect significant EPSS score increases indicating emerging threats.\"\"\"\n    timeseries = fetch_epss_timeseries(cve_id)\n    if len(timeseries) \u003C 2:\n        return False\n    sorted_data = sorted(timeseries, key=lambda x: x.get(\"date\", \"\"))\n    latest = float(sorted_data[-1].get(\"epss\", 0))\n    previous = float(sorted_data[-2].get(\"epss\", 0))\n    increase = latest - previous\n    if increase >= threshold:\n        print(f\"[!] EPSS spike detected for {cve_id}: {previous:.3f} -> {latest:.3f} (+{increase:.3f})\")\n        return True\n    return False\n```\n\n## References\n\n- [FIRST EPSS Official](https:\u002F\u002Fwww.first.org\u002Fepss\u002F)\n- [EPSS API Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fapi)\n- [EPSS Model Documentation](https:\u002F\u002Fwww.first.org\u002Fepss\u002Fmodel)\n- [EPSS Data Downloads](https:\u002F\u002Fepss.cyentia.com\u002F)\n- [Cyentia Institute Research](https:\u002F\u002Fwww.cyentia.com\u002Fepss\u002F)\n",{"name":5,"tags":49,"author":54,"domain":34,"license":15,"version":55,"category":5,"nist_csf":56,"subdomain":43,"description":7,"mitre_attack":61},[29,30,50,51,52,53,32],"first","exploit-prediction","cvss","risk-based","mahipal","1.0",[57,58,59,60],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[62,63,64],"T1190","T1203","T1068","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-epss-score-for-vulnerability-prioritization",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-epss-score-for-vulnerability-prioritization",{"tool":79,"command":80},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-epss-score-for-vulnerability-prioritization",{"tool":82,"command":83},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-epss-score-for-vulnerability-prioritization","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002FSKILL.md",true,[87,93,98,104,108,112,118],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",1774,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1655,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",2729,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",1358,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",5161,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Fscripts\u002Fagent.py",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fprocess.py",7649,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-epss-score-for-vulnerability-prioritization\u002Fscripts\u002Fprocess.py",[123,151,173,196,212,233],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":132,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[133,134,135,136,25,137,34,138,139,140,141,142,143,144,145,146,147,148,149,150],"integrity","backup","recovery","validating backup integrity for recovery","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1078","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":157,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[158,159,160,161,162,34,163,164,43,165,52,166,27,24,167,168,169,170,171,172],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","risk-management","remediation","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[180,181,148,34,182,183,184,144,145,185,186,187,188,189,190,191,192,193,194,195],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[180,203,204,181,148,162,34,205,183,141,206,207,144,145,208,186,168,209,210,211],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[180,219,220,221,222,223,34,224,225,226,183,227,144,228,229,230,189,231,148,232],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[240,241,242,243,34,244,245,246,247,248,249,228,250,251,231,252,232,253,254,255],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]