[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HN0FJ2PQFR0MP7X3VSW2PX":3,"skill-same:01M6HN0FJ2PQFR0MP7X3VSW2PX":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6HN0FJ2PQFR0MP7X3VSW2PX","performing-alert-triage-with-elastic-siem",null,"Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"siem","performing","with","alert","performing alert triage with elastic siem","elastic","alert triage","triage","soc","t1078","t1566","analysis","kibana","authentication","access","cm","alerts","classify","de","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-alert-triage-with-elastic-siem\ndescription: Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- elastic\n- siem\n- alert-triage\n- soc\n- elastic-security\n- detection\n- esql\n- kibana\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Restore Access\n- Application Protocol Command Analysis\n- Password Authentication\n- Reissue Credential\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\ncategory: performing-alert-triage-with-elastic-siem\n---\n# Performing Alert Triage with Elastic SIEM\n\n## Overview\n\nAlert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing alert triage with elastic siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Elastic Security deployed (version 8.x or later)\n- Elastic Agent or Beats configured for endpoint and network data collection\n- Detection rules enabled and generating alerts\n- Elastic Common Schema (ECS) compliance across data sources\n- Analyst access to Kibana Security app with appropriate privileges\n\n## Alert Triage Workflow\n\n### Step 1: Initial Alert Assessment (2 minutes)\n\nWhen viewing an alert in Elastic Security, review the alert details panel:\n\n```\nAlert Details Panel:\n- Rule Name and Description\n- Severity and Risk Score\n- MITRE ATT&CK Mapping\n- Host and User Context\n- Process Tree (for endpoint alerts)\n- Timeline of related events\n```\n\n#### Key Fields to Examine First\n\n| Field | Purpose | ECS Field |\n|---|---|---|\n| Rule severity | Initial priority assessment | `kibana.alert.severity` |\n| Risk score | Quantified threat level | `kibana.alert.risk_score` |\n| Host name | Affected system | `host.name` |\n| User name | Affected identity | `user.name` |\n| Process name | Executing process | `process.name` |\n| Source IP | Origin of activity | `source.ip` |\n| Destination IP | Target of activity | `destination.ip` |\n| MITRE tactic | Attack stage | `threat.tactic.name` |\n\n### Step 2: Context Gathering (3 minutes)\n\n#### Query Related Events with ES|QL\n\n```esql\nFROM logs-endpoint.events.*\n| WHERE host.name == \"affected-host\" AND @timestamp > NOW() - 1 HOUR\n| STATS count = COUNT(*) BY event.category, event.action\n| SORT count DESC\n```\n\n#### Find All Activity from Suspicious User\n\n```esql\nFROM logs-*\n| WHERE user.name == \"suspicious-user\" AND @timestamp > NOW() - 24 HOURS\n| STATS count = COUNT(*), unique_hosts = COUNT_DISTINCT(host.name) BY event.category\n| SORT count DESC\n```\n\n#### Check for Related Alerts from Same Source\n\n```esql\nFROM .alerts-security.alerts-default\n| WHERE source.ip == \"10.0.0.50\" AND @timestamp > NOW() - 24 HOURS\n| STATS alert_count = COUNT(*) BY kibana.alert.rule.name, kibana.alert.severity\n| SORT alert_count DESC\n```\n\n#### Investigate Lateral Movement from Same IP\n\n```esql\nFROM logs-system.auth-*\n| WHERE source.ip == \"10.0.0.50\" AND event.outcome == \"success\"\n| STATS login_count = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY user.name\n| WHERE hosts > 3\n```\n\n### Step 3: Threat Intelligence Enrichment (2 minutes)\n\nCheck indicators against threat intelligence:\n\n```esql\nFROM logs-ti_*\n| WHERE threat.indicator.ip == \"203.0.113.50\"\n| KEEP threat.indicator.type, threat.indicator.provider, threat.indicator.confidence, threat.feed.name\n```\n\n#### Check File Hash Against Known Threats\n\n```esql\nFROM logs-endpoint.events.file-*\n| WHERE file.hash.sha256 == \"abc123...\"\n| STATS occurrences = COUNT(*) BY host.name, file.path, user.name\n```\n\n### Step 4: Classification Decision (2 minutes)\n\n| Classification | Criteria | Action |\n|---|---|---|\n| True Positive | Confirmed malicious activity | Escalate to incident, begin containment |\n| Benign True Positive | Expected behavior matching rule | Document in alert notes, acknowledge |\n| False Positive | Rule triggered on benign activity | Mark as false positive, create tuning task |\n| Needs Investigation | Insufficient data for determination | Assign for deeper investigation |\n\n### Step 5: Documentation and Escalation (1 minute)\n\nFor each triaged alert, document:\n- Classification decision with rationale\n- Evidence artifacts examined\n- Related alerts or investigations\n- Recommended next steps\n\n## Detection Rules for Triage\n\n### Pre-Built Detection Rules\n\nElastic Security includes 1000+ pre-built detection rules organized by:\n- **MITRE ATT&CK Tactic**: Initial Access, Execution, Persistence, etc.\n- **Platform**: Windows, Linux, macOS, Cloud\n- **Data Source**: Endpoint, Network, Cloud, Identity\n\n### Custom Alert Correlation Rule\n\n```json\n{\n  \"name\": \"Multiple Failed Logins Followed by Success\",\n  \"type\": \"threshold\",\n  \"query\": \"event.category:authentication AND event.outcome:failure\",\n  \"threshold\": {\n    \"field\": [\"source.ip\", \"user.name\"],\n    \"value\": 5,\n    \"cardinality\": [\n      {\n        \"field\": \"user.name\",\n        \"value\": 3\n      }\n    ]\n  },\n  \"severity\": \"high\",\n  \"risk_score\": 73,\n  \"threat\": [\n    {\n      \"framework\": \"MITRE ATT&CK\",\n      \"tactic\": {\n        \"id\": \"TA0006\",\n        \"name\": \"Credential Access\"\n      },\n      \"technique\": [\n        {\n          \"id\": \"T1110\",\n          \"name\": \"Brute Force\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## AI-Assisted Triage\n\n### Elastic AI Assistant Integration\n\n1. Open alert in Elastic Security\n2. Click AI Assistant panel\n3. Use quick prompts:\n   - \"Summarize this alert\" - Get initial assessment\n   - \"Generate ES|QL query to find related activity\" - Expand investigation\n   - \"What are the recommended response actions?\" - Get playbook guidance\n   - \"Is this likely a false positive?\" - Get AI confidence assessment\n\n### Attack Discovery\n\nElastic's Attack Discovery automatically:\n- Groups related alerts into attack chains\n- Maps alerts to MITRE ATT&CK kill chain stages\n- Filters false positives using ML models\n- Prioritizes based on business impact\n- Provides narrative summary of the attack\n\n## Triage Prioritization Matrix\n\n| Risk Score | Severity | Asset Criticality | Response SLA |\n|---|---|---|---|\n| 90-100 | Critical | High | 15 minutes |\n| 70-89 | High | High | 30 minutes |\n| 70-89 | High | Medium | 1 hour |\n| 50-69 | Medium | Any | 4 hours |\n| 21-49 | Low | Any | 8 hours |\n| 1-20 | Informational | Any | 24 hours |\n\n## Triage Metrics and KPIs\n\n| Metric | Target | Measurement |\n|---|---|---|\n| Mean Time to Triage (MTTT) | \u003C 10 minutes | Time from alert creation to classification |\n| False Positive Rate | \u003C 30% | False positives \u002F total alerts |\n| Escalation Rate | 10-20% | Escalated alerts \u002F total alerts |\n| Alert Coverage | > 80% | Triaged alerts \u002F generated alerts per shift |\n| Reclassification Rate | \u003C 5% | Changed classifications \u002F total classified |\n\n## References\n\n- [Elastic Security - Triage Alerts Documentation](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fsecurity\u002Fai\u002Ftriage-alerts)\n- [SOC Analyst's Guide to Triage with Elastic](https:\u002F\u002Fsystemweakness.com\u002Ffrom-alert-to-action-a-soc-analysts-guide-to-triage-with-elastic-%EF%B8%8F-4e5354ab5da9)\n- [Elastic Blog - AI and 2025 SIEM Landscape](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Fai-siem-landscape)\n- [Reducing False Positives with Elastic and Tines](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Ffalse-positives-automated-siem-investigations-elastic-tines)\n","# Performing Alert Triage with Elastic SIEM\n\n## Overview\n\nAlert triage in Elastic Security is the systematic process of reviewing, classifying, and prioritizing security alerts to determine which represent genuine threats. Elastic's AI-driven Attack Discovery feature can triage hundreds of alerts down to discrete attack chains, but skilled analyst triage remains essential. A structured triage workflow typically takes 5-10 minutes per alert cluster using Elastic's built-in tools.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing alert triage with elastic siem\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Elastic Security deployed (version 8.x or later)\n- Elastic Agent or Beats configured for endpoint and network data collection\n- Detection rules enabled and generating alerts\n- Elastic Common Schema (ECS) compliance across data sources\n- Analyst access to Kibana Security app with appropriate privileges\n\n## Alert Triage Workflow\n\n### Step 1: Initial Alert Assessment (2 minutes)\n\nWhen viewing an alert in Elastic Security, review the alert details panel:\n\n```\nAlert Details Panel:\n- Rule Name and Description\n- Severity and Risk Score\n- MITRE ATT&CK Mapping\n- Host and User Context\n- Process Tree (for endpoint alerts)\n- Timeline of related events\n```\n\n#### Key Fields to Examine First\n\n| Field | Purpose | ECS Field |\n|---|---|---|\n| Rule severity | Initial priority assessment | `kibana.alert.severity` |\n| Risk score | Quantified threat level | `kibana.alert.risk_score` |\n| Host name | Affected system | `host.name` |\n| User name | Affected identity | `user.name` |\n| Process name | Executing process | `process.name` |\n| Source IP | Origin of activity | `source.ip` |\n| Destination IP | Target of activity | `destination.ip` |\n| MITRE tactic | Attack stage | `threat.tactic.name` |\n\n### Step 2: Context Gathering (3 minutes)\n\n#### Query Related Events with ES|QL\n\n```esql\nFROM logs-endpoint.events.*\n| WHERE host.name == \"affected-host\" AND @timestamp > NOW() - 1 HOUR\n| STATS count = COUNT(*) BY event.category, event.action\n| SORT count DESC\n```\n\n#### Find All Activity from Suspicious User\n\n```esql\nFROM logs-*\n| WHERE user.name == \"suspicious-user\" AND @timestamp > NOW() - 24 HOURS\n| STATS count = COUNT(*), unique_hosts = COUNT_DISTINCT(host.name) BY event.category\n| SORT count DESC\n```\n\n#### Check for Related Alerts from Same Source\n\n```esql\nFROM .alerts-security.alerts-default\n| WHERE source.ip == \"10.0.0.50\" AND @timestamp > NOW() - 24 HOURS\n| STATS alert_count = COUNT(*) BY kibana.alert.rule.name, kibana.alert.severity\n| SORT alert_count DESC\n```\n\n#### Investigate Lateral Movement from Same IP\n\n```esql\nFROM logs-system.auth-*\n| WHERE source.ip == \"10.0.0.50\" AND event.outcome == \"success\"\n| STATS login_count = COUNT(*), hosts = COUNT_DISTINCT(host.name) BY user.name\n| WHERE hosts > 3\n```\n\n### Step 3: Threat Intelligence Enrichment (2 minutes)\n\nCheck indicators against threat intelligence:\n\n```esql\nFROM logs-ti_*\n| WHERE threat.indicator.ip == \"203.0.113.50\"\n| KEEP threat.indicator.type, threat.indicator.provider, threat.indicator.confidence, threat.feed.name\n```\n\n#### Check File Hash Against Known Threats\n\n```esql\nFROM logs-endpoint.events.file-*\n| WHERE file.hash.sha256 == \"abc123...\"\n| STATS occurrences = COUNT(*) BY host.name, file.path, user.name\n```\n\n### Step 4: Classification Decision (2 minutes)\n\n| Classification | Criteria | Action |\n|---|---|---|\n| True Positive | Confirmed malicious activity | Escalate to incident, begin containment |\n| Benign True Positive | Expected behavior matching rule | Document in alert notes, acknowledge |\n| False Positive | Rule triggered on benign activity | Mark as false positive, create tuning task |\n| Needs Investigation | Insufficient data for determination | Assign for deeper investigation |\n\n### Step 5: Documentation and Escalation (1 minute)\n\nFor each triaged alert, document:\n- Classification decision with rationale\n- Evidence artifacts examined\n- Related alerts or investigations\n- Recommended next steps\n\n## Detection Rules for Triage\n\n### Pre-Built Detection Rules\n\nElastic Security includes 1000+ pre-built detection rules organized by:\n- **MITRE ATT&CK Tactic**: Initial Access, Execution, Persistence, etc.\n- **Platform**: Windows, Linux, macOS, Cloud\n- **Data Source**: Endpoint, Network, Cloud, Identity\n\n### Custom Alert Correlation Rule\n\n```json\n{\n  \"name\": \"Multiple Failed Logins Followed by Success\",\n  \"type\": \"threshold\",\n  \"query\": \"event.category:authentication AND event.outcome:failure\",\n  \"threshold\": {\n    \"field\": [\"source.ip\", \"user.name\"],\n    \"value\": 5,\n    \"cardinality\": [\n      {\n        \"field\": \"user.name\",\n        \"value\": 3\n      }\n    ]\n  },\n  \"severity\": \"high\",\n  \"risk_score\": 73,\n  \"threat\": [\n    {\n      \"framework\": \"MITRE ATT&CK\",\n      \"tactic\": {\n        \"id\": \"TA0006\",\n        \"name\": \"Credential Access\"\n      },\n      \"technique\": [\n        {\n          \"id\": \"T1110\",\n          \"name\": \"Brute Force\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n## AI-Assisted Triage\n\n### Elastic AI Assistant Integration\n\n1. Open alert in Elastic Security\n2. Click AI Assistant panel\n3. Use quick prompts:\n   - \"Summarize this alert\" - Get initial assessment\n   - \"Generate ES|QL query to find related activity\" - Expand investigation\n   - \"What are the recommended response actions?\" - Get playbook guidance\n   - \"Is this likely a false positive?\" - Get AI confidence assessment\n\n### Attack Discovery\n\nElastic's Attack Discovery automatically:\n- Groups related alerts into attack chains\n- Maps alerts to MITRE ATT&CK kill chain stages\n- Filters false positives using ML models\n- Prioritizes based on business impact\n- Provides narrative summary of the attack\n\n## Triage Prioritization Matrix\n\n| Risk Score | Severity | Asset Criticality | Response SLA |\n|---|---|---|---|\n| 90-100 | Critical | High | 15 minutes |\n| 70-89 | High | High | 30 minutes |\n| 70-89 | High | Medium | 1 hour |\n| 50-69 | Medium | Any | 4 hours |\n| 21-49 | Low | Any | 8 hours |\n| 1-20 | Informational | Any | 24 hours |\n\n## Triage Metrics and KPIs\n\n| Metric | Target | Measurement |\n|---|---|---|\n| Mean Time to Triage (MTTT) | \u003C 10 minutes | Time from alert creation to classification |\n| False Positive Rate | \u003C 30% | False positives \u002F total alerts |\n| Escalation Rate | 10-20% | Escalated alerts \u002F total alerts |\n| Alert Coverage | > 80% | Triaged alerts \u002F generated alerts per shift |\n| Reclassification Rate | \u003C 5% | Changed classifications \u002F total classified |\n\n## References\n\n- [Elastic Security - Triage Alerts Documentation](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fsecurity\u002Fai\u002Ftriage-alerts)\n- [SOC Analyst's Guide to Triage with Elastic](https:\u002F\u002Fsystemweakness.com\u002Ffrom-alert-to-action-a-soc-analysts-guide-to-triage-with-elastic-%EF%B8%8F-4e5354ab5da9)\n- [Elastic Blog - AI and 2025 SIEM Landscape](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Fai-siem-landscape)\n- [Reducing False Positives with Elastic and Tines](https:\u002F\u002Fwww.elastic.co\u002Fblog\u002Ffalse-positives-automated-siem-investigations-elastic-tines)\n",{"name":5,"tags":44,"author":49,"domain":38,"license":15,"version":50,"category":5,"nist_csf":51,"subdomain":56,"description":7,"mitre_attack":57,"d3fend_techniques":62},[24,19,45,27,46,47,48,31],"alert-triage","elastic-security","detection","esql","mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[58,59,60,61],"T1078","T1685.002","T1685.005","T1566",[63,64,65,66,67],"Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Reissue Credential","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fperforming-alert-triage-with-elastic-siem",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill performing-alert-triage-with-elastic-siem",{"tool":82,"command":83},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill performing-alert-triage-with-elastic-siem",{"tool":85,"command":86},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill performing-alert-triage-with-elastic-siem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",1203,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",2847,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",1699,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",1618,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",6797,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",11465,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fperforming-alert-triage-with-elastic-siem\u002Fscripts\u002Fprocess.py",[126,155,180,201,216,232],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":137,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[138,139,140,141,142,143,38,144,145,146,147,148,47,28,149,150,151,152,153,154],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[162,163,164,165,21,38,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[187,188,152,38,189,27,190,28,149,30,191,192,193,194,195,196,197,198,199,200],"security","triaging security incident","actions","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[187,208,209,188,152,21,38,210,27,147,211,212,28,149,213,191,175,36,214,215],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","incidents","initiate",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":222,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[187,223,224,225,35,226,38,19,227,228,27,229,28,29,230,231,194,34,152,37],"security alerts","splunk","triaging security alerts in splunk","review","dashboard","search","correlation-search","notable-events","incident-review",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":238,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[239,240,241,242,38,243,244,245,246,247,248,29,249,250,34,251,37,252,253,254],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]