[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CQR7SHF3GX8X93F7D9PD2":3,"skill-same:01M71CQR7SHF3GX8X93F7D9PD2":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M71CQR7SHF3GX8X93F7D9PD2","zerotrust-deviceposture-exploit",null,"Implementing device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting resource access.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fdeviceposture\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploit","zerotrust deviceposture exploit","endpoint","sonnet","zero trust","read","device-posture","jamf","intune","signals","crowdstrike-zta","zero-trust","endpoint-compliance","architecture","Bash","access","cybersecurity","CrowdStrike","assessment","implementing","2026-11-10 10:12:30",false,"---\nname: zerotrust-deviceposture-exploit\ndescription: Implementing device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting resource access.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- device-posture\n- zero-trust\n- endpoint-compliance\n- crowdstrike-zta\n- intune\n- conditional-access\n- jamf\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n","# Implementing Device Posture Assessment in Zero Trust\n\n## When to Use\n\n- When enforcing device health as a prerequisite for accessing corporate applications\n- When integrating CrowdStrike ZTA scores, Intune compliance, or Jamf device status into access decisions\n- When implementing CISA Zero Trust Maturity Model device pillar requirements\n- When building conditional access policies that adapt based on real-time endpoint security posture\n- When detecting and blocking access from compromised, unmanaged, or non-compliant devices\n\n**Do not use** for IoT or headless devices that cannot run posture agents, as a standalone security control without identity verification, or when real-time posture data is unavailable and stale compliance data would create false trust.\n\n## Prerequisites\n\n- Endpoint Detection and Response (EDR): CrowdStrike Falcon with ZTA module, or Microsoft Defender for Endpoint\n- Mobile Device Management (MDM): Microsoft Intune, Jamf Pro, or VMware Workspace ONE\n- Identity Provider: Microsoft Entra ID, Okta, or Ping Identity with conditional access capability\n- ZTNA Platform: Zscaler ZPA, Cloudflare Access, Palo Alto Prisma Access, or cloud-native IAP\n- API access to EDR\u002FMDM platforms for posture signal ingestion\n\n## Workflow\n\n### Step 1: Define Device Compliance Baselines\n\nEstablish minimum security requirements for each device category.\n\n```powershell\n# Microsoft Intune: Create device compliance policy via Graph API\nConnect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\"\n\n# Windows 10\u002F11 Compliance Policy\n$compliancePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windows10CompliancePolicy\"\n    displayName = \"Zero Trust - Windows Compliance\"\n    description = \"Minimum device requirements for zero trust access\"\n    osMinimumVersion = \"10.0.19045\"\n    bitLockerEnabled = $true\n    secureBootEnabled = $true\n    codeIntegrityEnabled = $true\n    tpmRequired = $true\n    antivirusRequired = $true\n    antiSpywareRequired = $true\n    defenderEnabled = $true\n    firewallEnabled = $true\n    passwordRequired = $true\n    passwordMinimumLength = 12\n    passwordRequiredType = \"alphanumeric\"\n    storageRequireEncryption = $true\n    scheduledActionsForRule = @(\n        @{\n            ruleName = \"PasswordRequired\"\n            scheduledActionConfigurations = @(\n                @{\n                    actionType = \"block\"\n                    gracePeriodHours = 24\n                    notificationTemplateId = \"\"\n                    notificationMessageCCList = @()\n                }\n            )\n        }\n    )\n}\n\nNew-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $compliancePolicy\n\n# macOS Compliance Policy via Jamf Pro API\ncurl -X POST \"https:\u002F\u002Fjamf.company.com\u002Fapi\u002Fv1\u002Fcompliance-policies\" \\\n  -H \"Authorization: Bearer ${JAMF_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust - macOS Compliance\",\n    \"rules\": [\n      {\"type\": \"os_version\", \"operator\": \">=\", \"value\": \"14.0\"},\n      {\"type\": \"filevault_enabled\", \"value\": true},\n      {\"type\": \"firewall_enabled\", \"value\": true},\n      {\"type\": \"gatekeeper_enabled\", \"value\": true},\n      {\"type\": \"sip_enabled\", \"value\": true},\n      {\"type\": \"auto_update_enabled\", \"value\": true},\n      {\"type\": \"screen_lock_timeout\", \"operator\": \"\u003C=\", \"value\": 300},\n      {\"type\": \"falcon_sensor_running\", \"value\": true}\n    ]\n  }'\n```\n\n### Step 2: Configure CrowdStrike Zero Trust Assessment\n\nEnable ZTA scoring and configure score thresholds for access tiers.\n\n```bash\n# CrowdStrike Falcon API: Query ZTA scores for all endpoints\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fentities\u002Fassessments\u002Fv1?ids=${DEVICE_AID}\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Response includes:\n# {\n#   \"aid\": \"device-agent-id\",\n#   \"assessment\": {\n#     \"overall\": 82,\n#     \"os\": 90,\n#     \"sensor_config\": 85,\n#     \"version\": \"7.14.16703\"\n#   },\n#   \"assessment_items\": {\n#     \"os_signals\": [\n#       {\"signal_id\": \"firmware_protection\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"disk_encryption\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"kernel_protection\", \"meets_criteria\": \"yes\"}\n#     ],\n#     \"sensor_signals\": [\n#       {\"signal_id\": \"sensor_version\", \"meets_criteria\": \"yes\"},\n#       {\"signal_id\": \"prevention_policies\", \"meets_criteria\": \"yes\"}\n#     ]\n#   }\n# }\n\n# Define ZTA score thresholds for access tiers\n# Tier 1 (Basic Access):      ZTA >= 50\n# Tier 2 (Standard Access):   ZTA >= 65\n# Tier 3 (Sensitive Access):  ZTA >= 80\n# Tier 4 (Critical Access):   ZTA >= 90\n\n# Query devices below minimum threshold\ncurl -X GET \"https:\u002F\u002Fapi.crowdstrike.com\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1?filter=assessment.overall:\u003C50\" \\\n  -H \"Authorization: Bearer ${CS_TOKEN}\"\n\n# CrowdStrike ZTA signals evaluated:\n# - OS patch level and version\n# - Disk encryption (BitLocker\u002FFileVault)\n# - Sensor version and configuration\n# - Prevention policy enforcement\n# - Firmware protection (Secure Boot)\n# - Kernel protection (SIP, Code Integrity)\n# - Firewall status\n```\n\n### Step 3: Integrate Device Posture with Entra ID Conditional Access\n\nCreate conditional access policies that require compliant devices.\n\n```powershell\n# Create Conditional Access policy requiring compliant device\nConnect-MgGraph -Scopes \"Policy.ReadWrite.ConditionalAccess\"\n\n$caPolicy = @{\n    displayName = \"Zero Trust - Require Compliant Device\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BreakGlass-Admins-Group-ID\")\n        }\n        platforms = @{\n            includePlatforms = @(\"all\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n            authenticationType = \"primaryAndSecondaryAuthentication\"\n            frequencyInterval = \"timeBased\"\n        }\n        persistentBrowser = @{\n            mode = \"never\"\n            isEnabled = $true\n        }\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create risk-based policy using device compliance + sign-in risk\n$riskPolicy = @{\n    displayName = \"Zero Trust - Block High Risk Sign-Ins on Non-Compliant Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"All\") }\n        users = @{ includeUsers = @(\"All\") }\n        signInRiskLevels = @(\"high\", \"medium\")\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True\"\n            }\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\n\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $riskPolicy\n```\n\n### Step 4: Configure Okta Device Trust with CrowdStrike Integration\n\nSet up Okta device trust policies using CrowdStrike posture signals.\n\n```bash\n# Okta: Configure CrowdStrike device trust integration\n# Admin Console > Security > Device Integrations > Add Integration\n\n# Okta API: Create device assurance policy\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fdevice-assurances\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Corporate Device Assurance\",\n    \"platform\": \"WINDOWS\",\n    \"osVersion\": {\n      \"minimum\": \"10.0.19045\"\n    },\n    \"diskEncryptionType\": {\n      \"include\": [\"ALL_INTERNAL_VOLUMES\"]\n    },\n    \"screenLockType\": {\n      \"include\": [\"BIOMETRIC\", \"PASSCODE\"]\n    },\n    \"secureHardwarePresent\": true,\n    \"thirdPartySignalProviders\": {\n      \"dtc\": {\n        \"browserVersion\": {\n          \"minimum\": \"120.0\"\n        },\n        \"builtInDnsClientEnabled\": true,\n        \"chromeRemoteDesktopAppBlocked\": true,\n        \"crowdStrikeCustomerId\": \"CS_CUSTOMER_ID\",\n        \"crowdStrikeAgentId\": \"REQUIRED\",\n        \"crowdStrikeVerifiedState\": {\n          \"include\": [\"RUNNING\"]\n        }\n      }\n    }\n  }'\n\n# Create Okta authentication policy with device assurance\ncurl -X POST \"https:\u002F\u002Fcompany.okta.com\u002Fapi\u002Fv1\u002Fpolicies\" \\\n  -H \"Authorization: SSWS ${OKTA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  --data '{\n    \"name\": \"Zero Trust Application Policy\",\n    \"type\": \"ACCESS_POLICY\",\n    \"conditions\": null,\n    \"rules\": [\n      {\n        \"name\": \"Managed Device Access\",\n        \"conditions\": {\n          \"device\": {\n            \"assurance\": {\n              \"include\": [\"DEVICE_ASSURANCE_POLICY_ID\"]\n            },\n            \"managed\": true,\n            \"registered\": true\n          },\n          \"people\": {\n            \"groups\": {\"include\": [\"EMPLOYEES_GROUP_ID\"]}\n          }\n        },\n        \"actions\": {\n          \"appSignOn\": {\n            \"access\": \"ALLOW\",\n            \"verificationMethod\": {\n              \"factorMode\": \"1FA\",\n              \"type\": \"ASSURANCE\"\n            }\n          }\n        }\n      },\n      {\n        \"name\": \"Unmanaged Device - Block\",\n        \"conditions\": {\n          \"device\": { \"managed\": false }\n        },\n        \"actions\": {\n          \"appSignOn\": { \"access\": \"DENY\" }\n        }\n      }\n    ]\n  }'\n```\n\n### Step 5: Implement Continuous Posture Monitoring\n\nSet up real-time monitoring of device compliance state changes.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor device posture compliance drift in real-time.\"\"\"\n\nimport requests\nimport time\nimport json\nfrom datetime import datetime, timezone\n\nCROWDSTRIKE_BASE = \"https:\u002F\u002Fapi.crowdstrike.com\"\nINTUNE_BASE = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\"\n\ndef get_cs_token(client_id: str, client_secret: str) -> str:\n    resp = requests.post(f\"{CROWDSTRIKE_BASE}\u002Foauth2\u002Ftoken\", data={\n        \"client_id\": client_id,\n        \"client_secret\": client_secret\n    })\n    return resp.json()[\"access_token\"]\n\ndef get_low_zta_devices(token: str, threshold: int = 50) -> list:\n    resp = requests.get(\n        f\"{CROWDSTRIKE_BASE}\u002Fzero-trust-assessment\u002Fqueries\u002Fassessments\u002Fv1\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\"filter\": f\"assessment.overall:\u003C{threshold}\", \"limit\": 100}\n    )\n    return resp.json().get(\"resources\", [])\n\ndef get_intune_noncompliant(token: str) -> list:\n    resp = requests.get(\n        f\"{INTUNE_BASE}\u002FdeviceManagement\u002FmanagedDevices\",\n        headers={\"Authorization\": f\"Bearer {token}\"},\n        params={\n            \"$filter\": \"complianceState eq 'noncompliant'\",\n            \"$select\": \"id,deviceName,userPrincipalName,complianceState,lastSyncDateTime,operatingSystem\"\n        }\n    )\n    return resp.json().get(\"value\", [])\n\ndef check_posture_drift(cs_token: str, intune_token: str):\n    print(f\"\\n[{datetime.now(timezone.utc).isoformat()}] Device Posture Check\")\n    print(\"=\" * 60)\n\n    low_zta = get_low_zta_devices(cs_token, threshold=50)\n    print(f\"CrowdStrike ZTA \u003C 50: {len(low_zta)} devices\")\n\n    noncompliant = get_intune_noncompliant(intune_token)\n    print(f\"Intune Non-Compliant: {len(noncompliant)} devices\")\n\n    for device in noncompliant[:10]:\n        print(f\"  - {device['deviceName']} ({device['userPrincipalName']}): \"\n              f\"{device['complianceState']} | Last sync: {device['lastSyncDateTime']}\")\n\n    return {\"low_zta_count\": len(low_zta), \"noncompliant_count\": len(noncompliant)}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Device Posture | Collection of endpoint security attributes (OS version, encryption, EDR status, patch level) evaluated before granting access |\n| CrowdStrike ZTA Score | Numerical score (1-100) calculated by CrowdStrike Falcon assessing endpoint security posture based on OS signals and sensor configuration |\n| Device Compliance Policy | MDM-defined rules specifying minimum security requirements (encryption, PIN, OS version) that devices must meet |\n| Conditional Access | Policy engine (Entra ID, Okta) that evaluates user identity, device compliance, location, and risk before allowing access |\n| Device Trust | Verification that an endpoint is managed, enrolled, and meets security baselines before treating it as trusted |\n| Posture Drift | Degradation of device security posture over time (expired patches, disabled encryption) that should trigger access revocation |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon ZTA**: Real-time endpoint posture scoring based on OS and sensor security signals\n- **Microsoft Intune**: MDM platform enforcing device compliance policies and reporting to Entra ID Conditional Access\n- **Jamf Pro**: Apple device management with compliance rules for macOS and iOS endpoints\n- **Microsoft Entra ID Conditional Access**: Policy engine consuming Intune compliance and risk signals for access decisions\n- **Okta Device Trust**: Device assurance policies integrating with CrowdStrike, Chrome Enterprise, and MDM platforms\n- **Cloudflare Device Posture**: WARP client-based posture checks for disk encryption, OS version, and third-party EDR\n\n## Common Scenarios\n\n### Scenario: Enforcing Device Compliance for 2,000 Endpoints Across Windows and macOS\n\n**Context**: A healthcare company with 2,000 endpoints (70% Windows, 30% macOS) must enforce HIPAA-compliant device posture before allowing access to patient data systems. Devices are managed by Intune (Windows) and Jamf (macOS) with CrowdStrike Falcon deployed on all endpoints.\n\n**Approach**:\n1. Define Windows compliance policy in Intune: BitLocker, Secure Boot, TPM, Defender enabled, OS >= 10.0.19045\n2. Define macOS compliance policy in Jamf: FileVault, Gatekeeper, SIP, Firewall, OS >= 14.0\n3. Configure CrowdStrike ZTA thresholds: >= 70 for general apps, >= 85 for patient data systems\n4. Create Entra ID Conditional Access policies requiring compliant device + MFA for all cloud apps\n5. Configure 24-hour grace period for newly non-compliant devices before blocking\n6. Set up weekly compliance report for IT showing non-compliant devices and remediation actions\n7. Implement automated remediation via Intune: push BitLocker enablement, deploy pending patches\n\n**Pitfalls**: Grace periods must be long enough for IT to remediate but short enough to limit risk exposure. CrowdStrike ZTA scores can fluctuate with sensor updates; avoid setting thresholds too aggressively initially. BYOD devices may lack MDM enrollment; provide a separate Browser Access path with reduced functionality for unmanaged devices.\n\n## Output Format\n\n```\nDevice Posture Assessment Report\n==================================================\nOrganization: HealthCorp\nReport Date: 2026-02-23\nTotal Managed Devices: 2,000\n\nCOMPLIANCE BY PLATFORM:\n  Windows (1,400 devices):\n    Compliant:              1,302 (93.0%)\n    Non-compliant:            98 (7.0%)\n    Top Issue: Missing patches (45), BitLocker disabled (23)\n\n  macOS (600 devices):\n    Compliant:                567 (94.5%)\n    Non-compliant:             33 (5.5%)\n    Top Issue: OS outdated (18), FileVault disabled (8)\n\nCROWDSTRIKE ZTA SCORES:\n  Average Score:              78.4\n  Devices >= 85 (Critical):  1,456 (72.8%)\n  Devices >= 70 (Standard):  1,812 (90.6%)\n  Devices \u003C 50 (Blocked):       34 (1.7%)\n\nCONDITIONAL ACCESS IMPACT (last 7 days):\n  Total sign-in attempts:    45,678\n  Blocked by posture:           312 (0.7%)\n  Remediated within 24h:        289 (92.6%)\n  Still non-compliant:           23\n\nPOSTURE DRIFT ALERTS:\n  Encryption disabled:            5\n  EDR sensor stopped:             3\n  OS downgraded:                  1\n```\n",{"name":5,"tags":49,"capec":51,"model":27,"tools":52,"domain":40,"maxTurns":56,"nist_csf":57,"subdomain":62,"description":7},[30,35,36,34,32,50,31],"conditional-access",[],[53,38,54,55],"Read","Glob","Grep",20,[58,59,60,61],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fzerotrust\u002Fdeviceposture\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-deviceposture-exploit",{"tool":76,"command":77},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-deviceposture-exploit",{"tool":79,"command":80},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-deviceposture-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fdeviceposture\u002Fexploit\u002FSKILL.md",true,[84],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"index.json","REFERENCE","参考文档",704,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fdeviceposture\u002Fexploit\u002Findex.json",[91,116,136,157,179,195],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,40,115],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[24,98,123,101,124,125,126,40,38,127,128,129,130,131,103,132,133,29,134,135],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[143,144,145,146,147,148,40,38,149,127,150,151,103,29,152,153,154,155,156,27],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[99,164,165,166,167,168,169,104,170,40,115,171,172,173,174,175,176,177,178,103],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[186,187,99,188,166,168,189,104,190,170,40,115,127,191,192,193,194,178,103,105],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":201,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[202,99,166,203,189,104,204,205,40,115,206,207,208,209,210,211,103,105,212,213],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]