[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HPF6JS9X72WP59094H3ASQ":3,"skill-same:01M6HPF6JS9X72WP59094H3ASQ":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident",null,"Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"incident","triaging security incident","security","SANS-PICERL","consistency","impact","scope","isolation","conversion","picerl","SOC-operations","incident-triage","severity-classification","analysis","t1490","t1078","NIST","soc","actions","cybersecurity","2026-11-10 10:12:30",false,"---\nname: triaging-security-incident\ndescription: Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-triage\n- NIST-800-61\n- SANS-PICERL\n- severity-classification\n- SOC-operations\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\ncategory: triaging-security-incident\n---\n# Triaging-Security-Incident\n\n## Overview\nPerforms initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.\n\n\n\n# Triaging Security Incidents\n\n## When to Use\n\n- A SIEM or EDR alert fires and requires human classification before escalation\n- Multiple concurrent alerts arrive and the SOC must prioritize response order\n- An end user reports suspicious activity and the incident needs initial categorization\n- A threat intelligence feed matches an IOC observed in the environment\n\n**Do not use** for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.\n\n## Prerequisites\n\n- Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data\n- Incident classification taxonomy aligned to NIST SP 800-61r3 categories\n- Predefined severity matrix mapping asset criticality to threat type\n- Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)\n- Asset inventory with business criticality ratings\n\n## Workflow\n\n### Step 1: Collect Initial Alert Data\n\nGather all available context from the triggering alert before making classification decisions:\n\n- **Alert source**: Which detection system generated the alert (EDR, SIEM, IDS\u002FIPS, firewall, user report)\n- **Timestamp**: When the event occurred and when it was detected (dwell time gap)\n- **Affected assets**: Hostnames, IP addresses, user accounts involved\n- **Alert fidelity**: Historical true-positive rate for this detection rule\n- **Raw evidence**: Log entries, packet captures, process execution chains\n\n```\nExample SIEM alert context:\nSource:       CrowdStrike Falcon\nDetection:    Suspicious PowerShell Execution (T1059.001)\nHost:         WORKSTATION-FIN-042\nUser:         jsmith@corp.example.com\nTimestamp:    2025-11-15T14:23:17Z\nSeverity:     High (detection rule confidence: 92%)\nProcess:      powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...\nParent:       outlook.exe (PID 4812)\n```\n\n### Step 2: Classify the Incident Type\n\nMap the alert to a standard incident category per NIST SP 800-61r3:\n\n| Category | Examples |\n|----------|----------|\n| Unauthorized Access | Compromised credentials, privilege escalation, IDOR |\n| Denial of Service | Volumetric DDoS, application-layer flood, resource exhaustion |\n| Malicious Code | Malware execution, ransomware detonation, cryptominer |\n| Improper Usage | Policy violation, insider data exfiltration, shadow IT |\n| Reconnaissance | Port scanning, directory enumeration, credential spraying |\n| Web Application Attack | SQL injection, XSS, SSRF exploitation |\n\n### Step 3: Assign Severity Using Impact Matrix\n\nCalculate severity by combining asset criticality with threat severity:\n\n```\nSeverity = f(Asset Criticality, Threat Type, Data Sensitivity, Lateral Movement Potential)\n\nCritical (P1): Crown jewel systems compromised, active data exfiltration, ransomware spreading\nHigh (P2):     Production system compromise, confirmed malware execution, privileged account takeover\nMedium (P3):   Non-production compromise, unsuccessful exploitation attempt, single endpoint malware\nLow (P4):      Reconnaissance activity, policy violation, benign true positive\n```\n\nResponse SLA targets:\n- P1: Acknowledge within 15 minutes, containment within 1 hour\n- P2: Acknowledge within 30 minutes, containment within 4 hours\n- P3: Acknowledge within 2 hours, investigation within 24 hours\n- P4: Acknowledge within 8 hours, investigation within 72 hours\n\n### Step 4: Perform Initial Enrichment\n\nBefore escalation, enrich the alert with contextual data:\n\n- **Threat intelligence**: Check IOCs (IP, hash, domain) against TI platforms (VirusTotal, OTX, MISP)\n- **Asset context**: Query CMDB for asset owner, business function, data classification\n- **User context**: Check identity provider for recent authentication anomalies, MFA status\n- **Historical correlation**: Search for related alerts on the same host\u002Fuser in the past 30 days\n- **Network context**: Verify if source\u002Fdestination IPs are internal, known partners, or external threat actors\n\n### Step 5: Document and Escalate\n\nCreate a structured triage record and route to the appropriate response tier:\n\n```\nIncident Triage Record\n━━━━━━━━━━━━━━━━━━━━━\nTicket ID:       INC-2025-1547\nTriage Analyst:  [analyst name]\nTriage Time:     2025-11-15T14:35:00Z (12 min from alert)\nClassification:  Malicious Code - Macro-based initial access\nSeverity:        P2 - High\nAffected Assets: WORKSTATION-FIN-042 (Finance dept, handles PII)\nAffected Users:  jsmith@corp.example.com\nIOCs Identified: powershell.exe spawned by outlook.exe, encoded command\nTI Matches:      Base64 payload matches known Qakbot loader pattern\nEscalation:      Tier 2 - Malware IR team\nRecommended:     Isolate endpoint, preserve memory dump, block sender domain\n```\n\n### Step 6: Initiate Containment Hold\n\nIf severity is P1 or P2, initiate immediate containment actions while awaiting full investigation:\n\n- Network-isolate the affected endpoint via EDR (CrowdStrike contain, Defender isolate)\n- Disable compromised user accounts in Active Directory or identity provider\n- Block identified malicious IPs\u002Fdomains at firewall and DNS sinkhole\n- Preserve volatile evidence (memory dump) before any remediation\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Triage** | Rapid assessment process to classify and prioritize security incidents based on severity and business impact |\n| **PICERL** | SANS incident response framework: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |\n| **Dwell Time** | Duration between initial compromise and detection; average is 10 days per Mandiant M-Trends 2025 |\n| **True Positive Rate** | Percentage of alerts from a detection rule that represent genuine security incidents |\n| **Crown Jewel Assets** | Systems and data critical to business operations whose compromise would cause severe organizational impact |\n| **Alert Fatigue** | Degraded analyst performance caused by high volumes of low-fidelity or false-positive alerts |\n| **Mean Time to Acknowledge (MTTA)** | Average time from alert generation to analyst acknowledgment; key SOC performance metric |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security**: SIEM platform for alert aggregation, correlation, and triage workflow management\n- **CrowdStrike Falcon**: EDR platform providing endpoint telemetry, detection, and one-click host containment\n- **TheHive**: Open-source incident response platform for case management, task tracking, and team collaboration\n- **MISP**: Threat intelligence sharing platform for IOC enrichment during triage\n- **Cortex XSOAR**: SOAR platform for automating enrichment playbooks and triage decision trees\n\n## Common Scenarios\n\n### Scenario: Encoded PowerShell from Email Client\n\n**Context**: SOC analyst receives a P2 alert showing `powershell.exe` with a Base64-encoded command spawned as a child process of `outlook.exe` on a finance department workstation.\n\n**Approach**:\n1. Decode the Base64 payload to determine the command intent\n2. Check the parent process chain for anomalies (Outlook spawning PowerShell is abnormal)\n3. Query VirusTotal for the decoded payload hash\n4. Correlate with email gateway logs to identify the triggering email and sender\n5. Check if other recipients in the organization received the same email\n6. Isolate the endpoint and escalate to Tier 2 with full triage context\n\n**Pitfalls**:\n- Dismissing encoded PowerShell as a false positive without decoding the payload\n- Failing to check for lateral spread to other recipients of the same phishing email\n- Remediating the endpoint before capturing volatile memory evidence\n\n## Output Format\n\n```\nINCIDENT TRIAGE REPORT\n======================\nTicket:          INC-[YYYY]-[NNNN]\nDate\u002FTime:       [ISO 8601 timestamp]\nTriage Analyst:  [Name]\nTime to Triage:  [minutes from alert to classification]\n\nCLASSIFICATION\nType:            [NIST category]\nSeverity:        [P1-P4] - [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence:      [High\u002FMedium\u002FLow]\nMITRE ATT&CK:   [Technique ID and name]\n\nAFFECTED SCOPE\nAssets:          [hostname(s), IP(s)]\nUsers:           [account(s)]\nData at Risk:    [classification level]\nBusiness Unit:   [department]\n\nEVIDENCE SUMMARY\n[Bullet list of key observations]\n\nENRICHMENT RESULTS\nTI Matches:      [Yes\u002FNo - details]\nHistorical:      [Related prior incidents]\nAsset Criticality: [rating]\n\nRECOMMENDED ACTIONS\n1. [Immediate action]\n2. [Investigation step]\n3. [Escalation target]\n\nESCALATION\nRouted To:       [Team\u002FIndividual]\nSLA Target:      [Containment deadline]\n```\n","# Triaging-Security-Incident\n\n## Overview\nPerforms initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.\n\n\n\n# Triaging Security Incidents\n\n## When to Use\n\n- A SIEM or EDR alert fires and requires human classification before escalation\n- Multiple concurrent alerts arrive and the SOC must prioritize response order\n- An end user reports suspicious activity and the incident needs initial categorization\n- A threat intelligence feed matches an IOC observed in the environment\n\n**Do not use** for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.\n\n## Prerequisites\n\n- Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data\n- Incident classification taxonomy aligned to NIST SP 800-61r3 categories\n- Predefined severity matrix mapping asset criticality to threat type\n- Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)\n- Asset inventory with business criticality ratings\n\n## Workflow\n\n### Step 1: Collect Initial Alert Data\n\nGather all available context from the triggering alert before making classification decisions:\n\n- **Alert source**: Which detection system generated the alert (EDR, SIEM, IDS\u002FIPS, firewall, user report)\n- **Timestamp**: When the event occurred and when it was detected (dwell time gap)\n- **Affected assets**: Hostnames, IP addresses, user accounts involved\n- **Alert fidelity**: Historical true-positive rate for this detection rule\n- **Raw evidence**: Log entries, packet captures, process execution chains\n\n```\nExample SIEM alert context:\nSource:       CrowdStrike Falcon\nDetection:    Suspicious PowerShell Execution (T1059.001)\nHost:         WORKSTATION-FIN-042\nUser:         jsmith@corp.example.com\nTimestamp:    2025-11-15T14:23:17Z\nSeverity:     High (detection rule confidence: 92%)\nProcess:      powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...\nParent:       outlook.exe (PID 4812)\n```\n\n### Step 2: Classify the Incident Type\n\nMap the alert to a standard incident category per NIST SP 800-61r3:\n\n| Category | Examples |\n|----------|----------|\n| Unauthorized Access | Compromised credentials, privilege escalation, IDOR |\n| Denial of Service | Volumetric DDoS, application-layer flood, resource exhaustion |\n| Malicious Code | Malware execution, ransomware detonation, cryptominer |\n| Improper Usage | Policy violation, insider data exfiltration, shadow IT |\n| Reconnaissance | Port scanning, directory enumeration, credential spraying |\n| Web Application Attack | SQL injection, XSS, SSRF exploitation |\n\n### Step 3: Assign Severity Using Impact Matrix\n\nCalculate severity by combining asset criticality with threat severity:\n\n```\nSeverity = f(Asset Criticality, Threat Type, Data Sensitivity, Lateral Movement Potential)\n\nCritical (P1): Crown jewel systems compromised, active data exfiltration, ransomware spreading\nHigh (P2):     Production system compromise, confirmed malware execution, privileged account takeover\nMedium (P3):   Non-production compromise, unsuccessful exploitation attempt, single endpoint malware\nLow (P4):      Reconnaissance activity, policy violation, benign true positive\n```\n\nResponse SLA targets:\n- P1: Acknowledge within 15 minutes, containment within 1 hour\n- P2: Acknowledge within 30 minutes, containment within 4 hours\n- P3: Acknowledge within 2 hours, investigation within 24 hours\n- P4: Acknowledge within 8 hours, investigation within 72 hours\n\n### Step 4: Perform Initial Enrichment\n\nBefore escalation, enrich the alert with contextual data:\n\n- **Threat intelligence**: Check IOCs (IP, hash, domain) against TI platforms (VirusTotal, OTX, MISP)\n- **Asset context**: Query CMDB for asset owner, business function, data classification\n- **User context**: Check identity provider for recent authentication anomalies, MFA status\n- **Historical correlation**: Search for related alerts on the same host\u002Fuser in the past 30 days\n- **Network context**: Verify if source\u002Fdestination IPs are internal, known partners, or external threat actors\n\n### Step 5: Document and Escalate\n\nCreate a structured triage record and route to the appropriate response tier:\n\n```\nIncident Triage Record\n━━━━━━━━━━━━━━━━━━━━━\nTicket ID:       INC-2025-1547\nTriage Analyst:  [analyst name]\nTriage Time:     2025-11-15T14:35:00Z (12 min from alert)\nClassification:  Malicious Code - Macro-based initial access\nSeverity:        P2 - High\nAffected Assets: WORKSTATION-FIN-042 (Finance dept, handles PII)\nAffected Users:  jsmith@corp.example.com\nIOCs Identified: powershell.exe spawned by outlook.exe, encoded command\nTI Matches:      Base64 payload matches known Qakbot loader pattern\nEscalation:      Tier 2 - Malware IR team\nRecommended:     Isolate endpoint, preserve memory dump, block sender domain\n```\n\n### Step 6: Initiate Containment Hold\n\nIf severity is P1 or P2, initiate immediate containment actions while awaiting full investigation:\n\n- Network-isolate the affected endpoint via EDR (CrowdStrike contain, Defender isolate)\n- Disable compromised user accounts in Active Directory or identity provider\n- Block identified malicious IPs\u002Fdomains at firewall and DNS sinkhole\n- Preserve volatile evidence (memory dump) before any remediation\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Triage** | Rapid assessment process to classify and prioritize security incidents based on severity and business impact |\n| **PICERL** | SANS incident response framework: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |\n| **Dwell Time** | Duration between initial compromise and detection; average is 10 days per Mandiant M-Trends 2025 |\n| **True Positive Rate** | Percentage of alerts from a detection rule that represent genuine security incidents |\n| **Crown Jewel Assets** | Systems and data critical to business operations whose compromise would cause severe organizational impact |\n| **Alert Fatigue** | Degraded analyst performance caused by high volumes of low-fidelity or false-positive alerts |\n| **Mean Time to Acknowledge (MTTA)** | Average time from alert generation to analyst acknowledgment; key SOC performance metric |\n\n## Tools & Systems\n\n- **Splunk Enterprise Security**: SIEM platform for alert aggregation, correlation, and triage workflow management\n- **CrowdStrike Falcon**: EDR platform providing endpoint telemetry, detection, and one-click host containment\n- **TheHive**: Open-source incident response platform for case management, task tracking, and team collaboration\n- **MISP**: Threat intelligence sharing platform for IOC enrichment during triage\n- **Cortex XSOAR**: SOAR platform for automating enrichment playbooks and triage decision trees\n\n## Common Scenarios\n\n### Scenario: Encoded PowerShell from Email Client\n\n**Context**: SOC analyst receives a P2 alert showing `powershell.exe` with a Base64-encoded command spawned as a child process of `outlook.exe` on a finance department workstation.\n\n**Approach**:\n1. Decode the Base64 payload to determine the command intent\n2. Check the parent process chain for anomalies (Outlook spawning PowerShell is abnormal)\n3. Query VirusTotal for the decoded payload hash\n4. Correlate with email gateway logs to identify the triggering email and sender\n5. Check if other recipients in the organization received the same email\n6. Isolate the endpoint and escalate to Tier 2 with full triage context\n\n**Pitfalls**:\n- Dismissing encoded PowerShell as a false positive without decoding the payload\n- Failing to check for lateral spread to other recipients of the same phishing email\n- Remediating the endpoint before capturing volatile memory evidence\n\n## Output Format\n\n```\nINCIDENT TRIAGE REPORT\n======================\nTicket:          INC-[YYYY]-[NNNN]\nDate\u002FTime:       [ISO 8601 timestamp]\nTriage Analyst:  [Name]\nTime to Triage:  [minutes from alert to classification]\n\nCLASSIFICATION\nType:            [NIST category]\nSeverity:        [P1-P4] - [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence:      [High\u002FMedium\u002FLow]\nMITRE ATT&CK:   [Technique ID and name]\n\nAFFECTED SCOPE\nAssets:          [hostname(s), IP(s)]\nUsers:           [account(s)]\nData at Risk:    [classification level]\nBusiness Unit:   [department]\n\nEVIDENCE SUMMARY\n[Bullet list of key observations]\n\nENRICHMENT RESULTS\nTI Matches:      [Yes\u002FNo - details]\nHistorical:      [Related prior incidents]\nAsset Criticality: [rating]\n\nRECOMMENDED ACTIONS\n1. [Immediate action]\n2. [Investigation step]\n3. [Escalation target]\n\nESCALATION\nRouted To:       [Team\u002FIndividual]\nSLA Target:      [Containment deadline]\n```\n",{"name":5,"tags":44,"author":46,"domain":38,"license":15,"version":47,"category":5,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54,"d3fend_techniques":59},[30,45,22,31,29],"NIST-800-61","mahipal","1.0.0",[49,50,51,52],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[55,56,57,58],"T1486","T1490","T1070","T1078",[60,61,62,63,64],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Ftriaging-security-incident",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill triaging-security-incident",{"tool":79,"command":80},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill triaging-security-incident",{"tool":82,"command":83},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill triaging-security-incident","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2376,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",10739,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002Fscripts\u002Fagent.py",[105,132,158,174,195,218],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":116,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[111],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[117,118,119,120,121,122,38,123,124,125,53,126,127,34,33,128,129,19,130,131],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[139,140,141,142,143,38,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[21,165,166,20,19,143,38,167,36,53,168,169,34,33,170,31,153,171,172,173],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[21,181,182,183,184,185,38,186,187,188,36,189,34,190,191,192,29,193,19,194],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[202,203,204,205,38,206,207,208,209,210,211,190,212,213,193,214,194,215,216,217],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":222,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":229,"publishedAt":39},"01M6HPD4AQQWZ5HR59SA1V5TNC","lambdatest-agent-skills","Production-grade test automation skills for 46 frameworks across E2E, unit, mobile, BDD, visual, and cloud testing in 15+ languages.","MIT","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftesting\u002Flambdatest-agent-skills\u002FSKILL.md",[225,226],{"categoryNo":112,"categoryName":113,"taxonomyType":114,"taxonomyTypeDesc":115},{"categoryNo":227,"categoryName":228,"taxonomyType":114,"taxonomyTypeDesc":115},"01JBSEEDCAT000000000000023","Skill与智能体开发",[230,231,122,232,233,234,235,236,237,238,239,65,240,241,242,243,244,245,246,121],"lambdatest","lambdatest agent skills","safe","gemini","copilot","selenium","mobile","mobile-testing","pytest","community","jest","across","cypress","unit","appium","test-automation","unit-testing"]