[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DH4T438NQYV4TANNM0RBN":3,"skill-same:01M71DH4T438NQYV4TANNM0RBN":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M71DH4T438NQYV4TANNM0RBN","identity-rbac-entitlement",null,"Identity Rbac Entitlement.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-rbac-entitlement\u002FSKILL.md",[],[19,20,21,22],"identity","rbac","identity rbac entitlement","cybersecurity","2026-11-10 10:12:30",false,"---\nname: identity-rbac-entitlement\ndescription: \"Identity Rbac Entitlement.\"\ndomain: cybersecurity\n---\n\n|\n| **Certification Campaign** | An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications |\n| **Access Review** | Individual review unit within a campaign where a certifier examines and makes approve\u002Frevoke decisions on specific user entitlements |\n| **Entitlement** | A specific permission, group membership, role, or access right granted to an identity on a target application |\n| **Certifier** | The reviewer responsible for making access decisions, typically a manager, application owner, or data owner |\n| **Revocation** | Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal |\n| **SOD Violation** | Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk |\n| **Remediation** | Automated or manual process of removing revoked access from target systems following certification decisions |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ**: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting\n- **IdentityIQ Compliance Manager**: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence\n- **SailPoint REST API**: Programmatic interface for automating certification campaigns, querying status, and extracting audit data\n- **IdentityIQ Report Builder**: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis\n\n## Common Scenarios\n\n### Scenario: SOX Compliance Quarterly Access Review\n\n**Context**: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.\n\n**Approach**:\n1. Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems\n2. Configure manager certifications with 30-day active period for general access review\n3. Create targeted entitlement certifications for privileged financial roles with application owner as certifier\n4. Enable SOD policy checks to flag AP\u002FAR, GL posting\u002Fapproval, and user admin\u002Ftransaction conflicts\n5. Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25\n6. Set default-revoke for items not reviewed by campaign end to enforce completion accountability\n7. Generate signed certification reports with decision audit trail for external auditors\n8. Track revocation completion to ensure all denied access is actually removed from target systems\n\n**Pitfalls**:\n- Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand\n- Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews\n- Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)\n- Missing service accounts from review scope when they have access to financial systems\n\n## Output Format\n\n```\nACCESS CERTIFICATION CAMPAIGN REPORT\n=======================================\nCampaign:          Q1-2026 Manager Access Review\nType:              Manager Certification\nPeriod:            2026-01-15 to 2026-02-14\nStatus:            COMPLETED\n\nCOVERAGE\nIdentities Reviewed:    2,847\nApplications In Scope:  34\nTotal Entitlements:     18,392\n\nDECISION SUMMARY\nApproved:              16,841 (91.6%)\nRevoked:                1,203 (6.5%)\nMitigated:                 198 (1.1%)\nDelegated:                 150 (0.8%)\n\nREVOCATION STATUS\nProvisioned:            1,089 \u002F 1,203 (90.5%)\nPending:                   87\nFailed:                    27 (manual work items created)\n\nSOD VIOLATIONS\nFlagged:                   43\nRemediated:                31\nCompensating Controls:     12\n\nCERTIFIER COMPLIANCE\nOn-Time Completion:     89.3%\nRequired Escalation:    14 certifiers\nAverage Review Time:    3.2 minutes per item\n\nSIGN-OFF\nCampaign Signed:        2026-02-14 by compliance-admin\nAudit Evidence:         Exported to \u002Freports\u002FQ1-2026-cert-evidence.pdf\n```\n","|\n| **Certification Campaign** | An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications |\n| **Access Review** | Individual review unit within a campaign where a certifier examines and makes approve\u002Frevoke decisions on specific user entitlements |\n| **Entitlement** | A specific permission, group membership, role, or access right granted to an identity on a target application |\n| **Certifier** | The reviewer responsible for making access decisions, typically a manager, application owner, or data owner |\n| **Revocation** | Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal |\n| **SOD Violation** | Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk |\n| **Remediation** | Automated or manual process of removing revoked access from target systems following certification decisions |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ**: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting\n- **IdentityIQ Compliance Manager**: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence\n- **SailPoint REST API**: Programmatic interface for automating certification campaigns, querying status, and extracting audit data\n- **IdentityIQ Report Builder**: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis\n\n## Common Scenarios\n\n### Scenario: SOX Compliance Quarterly Access Review\n\n**Context**: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.\n\n**Approach**:\n1. Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems\n2. Configure manager certifications with 30-day active period for general access review\n3. Create targeted entitlement certifications for privileged financial roles with application owner as certifier\n4. Enable SOD policy checks to flag AP\u002FAR, GL posting\u002Fapproval, and user admin\u002Ftransaction conflicts\n5. Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25\n6. Set default-revoke for items not reviewed by campaign end to enforce completion accountability\n7. Generate signed certification reports with decision audit trail for external auditors\n8. Track revocation completion to ensure all denied access is actually removed from target systems\n\n**Pitfalls**:\n- Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand\n- Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews\n- Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)\n- Missing service accounts from review scope when they have access to financial systems\n\n## Output Format\n\n```\nACCESS CERTIFICATION CAMPAIGN REPORT\n=======================================\nCampaign:          Q1-2026 Manager Access Review\nType:              Manager Certification\nPeriod:            2026-01-15 to 2026-02-14\nStatus:            COMPLETED\n\nCOVERAGE\nIdentities Reviewed:    2,847\nApplications In Scope:  34\nTotal Entitlements:     18,392\n\nDECISION SUMMARY\nApproved:              16,841 (91.6%)\nRevoked:                1,203 (6.5%)\nMitigated:                 198 (1.1%)\nDelegated:                 150 (0.8%)\n\nREVOCATION STATUS\nProvisioned:            1,089 \u002F 1,203 (90.5%)\nPending:                   87\nFailed:                    27 (manual work items created)\n\nSOD VIOLATIONS\nFlagged:                   43\nRemediated:                31\nCompensating Controls:     12\n\nCERTIFIER COMPLIANCE\nOn-Time Completion:     89.3%\nRequired Escalation:    14 certifiers\nAverage Review Time:    3.2 minutes per item\n\nSIGN-OFF\nCampaign Signed:        2026-02-14 by compliance-admin\nAudit Evidence:         Exported to \u002Freports\u002FQ1-2026-cert-evidence.pdf\n```\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity-rbac-entitlement","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-rbac-entitlement",{"tool":41,"command":42},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-rbac-entitlement",{"tool":44,"command":45},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-rbac-entitlement","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-rbac-entitlement\u002FSKILL.md",true,[49],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"index.json","REFERENCE","参考文档",500,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-rbac-entitlement\u002Findex.json",[56,81,104,126,148,164],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":23},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,22,80],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[88,63,89,66,90,91,92,22,93,94,95,96,97,98,68,99,100,101,102,103],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":23},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[111,112,113,114,115,116,22,93,117,94,118,119,68,101,120,121,122,123,124,125],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":23},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[64,133,134,135,136,137,138,69,139,22,80,140,141,142,143,144,145,146,147,68],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":23},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[155,156,64,157,135,137,158,69,159,139,22,80,94,160,161,162,163,147,68,70],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":23},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[171,64,135,172,158,69,173,174,22,80,175,176,177,178,179,180,68,70,181,182],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]