[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M72A70JRYTHFE1MBXETFA06N":3,"skill-same:01M72A70JRYTHFE1MBXETFA06N":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":70,"install":71,"resources":84},"01M72A70JRYTHFE1MBXETFA06N","Security Monitoring",null,"Automate security monitoring, threat detection, incident response, and compliance workflows","claude-office-skills\u002Fskills","claude-office-skills","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F258027507?v=4","01M729XQC9FBRQ54AQZS0KY3ZK","AGI Lab","01M729XQCYW6WF9GY762P9RNQJ",572,"MIT","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fsecurity-monitoring\u002FSKILL.md",[],[],"2026-11-10 18:39:20",false,"---\nname: Security Monitoring\ndescription: Automate security monitoring, threat detection, incident response, and compliance workflows\nversion: 1.0.0\nauthor: Claude Office Skills\ncategory: security\ntags:\n  - security\n  - monitoring\n  - siem\n  - incident-response\n  - compliance\ndepartment: security\nmodels:\n  - claude-3-opus\n  - claude-3-sonnet\n  - gpt-4\nmcp:\n  server: security-mcp\n  tools:\n    - siem_query\n    - alert_create\n    - incident_manage\n    - compliance_check\ncapabilities:\n  - Threat detection and alerting\n  - Incident response automation\n  - Log analysis and correlation\n  - Compliance monitoring\ninput:\n  - Security logs\n  - Alert rules\n  - Incident data\n  - Compliance requirements\noutput:\n  - Security alerts\n  - Incident reports\n  - Compliance dashboards\n  - Threat intelligence\nlanguages:\n  - en\nrelated_skills:\n  - devops-automation\n  - log-analysis\n  - compliance-audit\n---\n\n# Security Monitoring\n\nComprehensive skill for security monitoring, threat detection, and incident response automation.\n\n## Core Architecture\n\n### Security Monitoring Stack\n\n```\nSECURITY MONITORING ARCHITECTURE:\n┌─────────────────────────────────────────────────────────┐\n│                     DATA SOURCES                         │\n├──────────┬──────────┬──────────┬──────────┬────────────┤\n│ Firewall │ Endpoint │ Cloud    │ Network  │ Application│\n│ Logs     │ Logs     │ Logs     │ Traffic  │ Logs       │\n└────┬─────┴────┬─────┴────┬─────┴────┬─────┴─────┬──────┘\n     │          │          │          │           │\n     └──────────┴──────────┴────┬─────┴───────────┘\n                                ▼\n┌─────────────────────────────────────────────────────────┐\n│                   LOG AGGREGATION                        │\n│              (SIEM \u002F Security Data Lake)                 │\n└────────────────────────┬────────────────────────────────┘\n                         ▼\n┌─────────────────────────────────────────────────────────┐\n│                   DETECTION ENGINE                       │\n│  • Rule-based Detection    • ML Anomaly Detection       │\n│  • Correlation Rules       • Threat Intelligence        │\n└────────────────────────┬────────────────────────────────┘\n                         ▼\n┌─────────────────────────────────────────────────────────┐\n│                   RESPONSE & ACTION                      │\n│  • Alerting        • Automated Response                 │\n│  • Ticketing       • Containment                        │\n└─────────────────────────────────────────────────────────┘\n```\n\n## Detection Rules\n\n### Rule Categories\n\n```yaml\ndetection_rules:\n  authentication:\n    - name: brute_force_login\n      description: \"Multiple failed login attempts\"\n      query: |\n        event.type == \"authentication\" AND\n        event.outcome == \"failure\" AND\n        COUNT(*) > 5 WITHIN 5 minutes\n        GROUP BY source.ip\n      severity: high\n      actions:\n        - create_alert\n        - block_ip_temporarily\n        \n    - name: impossible_travel\n      description: \"Login from geographically distant locations\"\n      query: |\n        event.type == \"authentication\" AND\n        event.outcome == \"success\" AND\n        geo_distance(prev_location, current_location) > 500km AND\n        time_diff \u003C 1 hour\n      severity: critical\n      actions:\n        - create_alert\n        - require_mfa_verification\n        - notify_user\n        \n  data_exfiltration:\n    - name: large_data_transfer\n      description: \"Unusual data egress volume\"\n      query: |\n        event.type == \"network\" AND\n        direction == \"outbound\" AND\n        bytes_transferred > 100MB WITHIN 1 hour\n        GROUP BY user.id\n      severity: medium\n      actions:\n        - create_alert\n        - capture_network_session\n        \n  malware:\n    - name: known_malware_hash\n      description: \"File matches known malware signature\"\n      query: |\n        event.type == \"file\" AND\n        file.hash.sha256 IN threat_intelligence.malware_hashes\n      severity: critical\n      actions:\n        - quarantine_file\n        - isolate_endpoint\n        - create_incident\n```\n\n### Correlation Rules\n\n```yaml\ncorrelation_rules:\n  - name: lateral_movement_detection\n    description: \"Detect potential lateral movement\"\n    events:\n      - type: authentication_success\n        from: internal_network\n      - type: process_execution\n        name: [\"psexec\", \"wmic\", \"powershell\"]\n        within: 5_minutes\n      - type: network_connection\n        to: different_internal_host\n        within: 10_minutes\n    severity: high\n    \n  - name: privilege_escalation_chain\n    description: \"Detect privilege escalation attempts\"\n    events:\n      - type: authentication\n        account_type: standard_user\n      - type: process_execution\n        elevated: true\n        within: 30_minutes\n      - type: account_modification\n        action: add_to_admin_group\n        within: 1_hour\n    severity: critical\n```\n\n## Alert Management\n\n### Alert Configuration\n\n```yaml\nalert_config:\n  severity_levels:\n    critical:\n      response_time: 15_minutes\n      notifications:\n        - pagerduty: security_oncall\n        - slack: \"#security-critical\"\n        - email: security-team@company.com\n      auto_escalation: 30_minutes\n      \n    high:\n      response_time: 1_hour\n      notifications:\n        - slack: \"#security-alerts\"\n        - email: security-team@company.com\n        \n    medium:\n      response_time: 4_hours\n      notifications:\n        - slack: \"#security-alerts\"\n        \n    low:\n      response_time: 24_hours\n      notifications:\n        - ticket_only: true\n        \n  deduplication:\n    enabled: true\n    window: 1_hour\n    key_fields:\n      - rule_id\n      - source.ip\n      - destination.ip\n```\n\n### Alert Template\n\n```yaml\nalert_template:\n  title: \"[{{severity}}] {{rule_name}}\"\n  \n  body: |\n    ## Security Alert\n    \n    **Rule:** {{rule_name}}\n    **Severity:** {{severity}}\n    **Time:** {{timestamp}}\n    \n    ### Details\n    - **Source IP:** {{source.ip}}\n    - **Source User:** {{user.name}}\n    - **Destination:** {{destination.ip}}\n    - **Action:** {{event.action}}\n    \n    ### Context\n    {{event_context}}\n    \n    ### Recommended Actions\n    {{#each recommended_actions}}\n    - {{this}}\n    {{\u002Feach}}\n    \n    ### Related Events\n    {{related_events_link}}\n```\n\n## Incident Response\n\n### Incident Workflow\n\n```\nINCIDENT RESPONSE WORKFLOW:\n┌─────────────────┐\n│    Detection    │\n│  (Alert Fired)  │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│     Triage      │\n│  - Validate     │\n│  - Classify     │\n│  - Prioritize   │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│   Containment   │\n│  - Isolate      │\n│  - Block        │\n│  - Preserve     │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│  Investigation  │\n│  - Collect      │\n│  - Analyze      │\n│  - Correlate    │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│   Eradication   │\n│  - Remove       │\n│  - Patch        │\n│  - Harden       │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│    Recovery     │\n│  - Restore      │\n│  - Verify       │\n│  - Monitor      │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│  Post-Incident  │\n│  - Document     │\n│  - Review       │\n│  - Improve      │\n└─────────────────┘\n```\n\n### Playbook Automation\n\n```yaml\nplaybooks:\n  - name: ransomware_response\n    trigger:\n      alert_type: ransomware_detected\n    steps:\n      - name: isolate_endpoint\n        action: network_isolate\n        target: \"{{affected_host}}\"\n        \n      - name: disable_account\n        action: disable_ad_account\n        target: \"{{user.name}}\"\n        \n      - name: preserve_evidence\n        action: capture_memory_image\n        target: \"{{affected_host}}\"\n        \n      - name: notify_stakeholders\n        action: send_notification\n        channels:\n          - security_team\n          - it_leadership\n          - legal_if_needed\n          \n      - name: create_incident\n        action: create_ticket\n        priority: critical\n        template: ransomware_incident\n        \n  - name: phishing_response\n    trigger:\n      alert_type: phishing_reported\n    steps:\n      - name: analyze_email\n        action: extract_iocs\n        extract:\n          - sender_address\n          - urls\n          - attachments\n          \n      - name: check_recipients\n        action: query_email_logs\n        find: all_recipients\n        \n      - name: block_sender\n        action: add_to_blocklist\n        target: \"{{sender_address}}\"\n        \n      - name: remove_emails\n        action: delete_from_mailboxes\n        target: all_recipients\n```\n\n## Compliance Monitoring\n\n### Compliance Frameworks\n\n```yaml\ncompliance_checks:\n  pci_dss:\n    - requirement: \"10.2.1\"\n      description: \"Log all access to cardholder data\"\n      query: |\n        SELECT * FROM audit_logs\n        WHERE data_classification = 'cardholder'\n        AND timestamp > NOW() - INTERVAL '24 hours'\n      expected: all_access_logged\n      \n    - requirement: \"10.6.1\"\n      description: \"Review logs daily\"\n      check: daily_log_review_completed\n      \n  hipaa:\n    - requirement: \"164.312(b)\"\n      description: \"Audit controls\"\n      checks:\n        - audit_logging_enabled\n        - log_retention_6_years\n        - tamper_protection\n        \n  soc2:\n    - control: \"CC6.1\"\n      description: \"Logical access security\"\n      checks:\n        - mfa_enabled\n        - password_policy_enforced\n        - access_reviews_quarterly\n```\n\n### Compliance Dashboard\n\n```\nCOMPLIANCE STATUS DASHBOARD\n═══════════════════════════════════════\n\nPCI-DSS:      ████████████░░░░ 92% ✓\nHIPAA:        ██████████████░░ 98% ✓\nSOC 2:        █████████████░░░ 95% ✓\nGDPR:         ████████████████ 100% ✓\n\nFINDINGS BY SEVERITY:\nCritical  ░░░░░░░░░░░░░░░░ 0\nHigh      ██░░░░░░░░░░░░░░ 3\nMedium    ████░░░░░░░░░░░░ 8\nLow       ██████░░░░░░░░░░ 15\n\nUPCOMING DEADLINES:\n• Jan 30: Quarterly access review\n• Feb 15: Penetration test scheduled\n• Feb 28: Annual audit prep\n```\n\n## Security Metrics\n\n### KPI Dashboard\n\n```\nSECURITY OPERATIONS METRICS\n═══════════════════════════════════════\n\nDETECTION:\nMTTD (Mean Time to Detect): 4.2 hours\nAlert Volume: 1,234\u002Fday\nTrue Positive Rate: 78%\n\nRESPONSE:\nMTTR (Mean Time to Respond): 1.8 hours\nIncidents Resolved: 23\u002Fweek\nSLA Compliance: 96%\n\nCOVERAGE:\nAssets Monitored: 2,456\u002F2,500 (98%)\nLog Sources: 45 active\nDetection Rules: 234 active\n\nTHREAT LANDSCAPE:\nBlocked Attacks: 12,456\u002Fmonth\nVulnerabilities: 89 open\nPatch Compliance: 94%\n```\n\n### Reporting\n\n```yaml\nreports:\n  - name: daily_security_briefing\n    schedule: \"0 8 * * *\"\n    recipients: security_team\n    sections:\n      - overnight_alerts\n      - active_incidents\n      - threat_intelligence_updates\n      \n  - name: weekly_executive_summary\n    schedule: \"0 9 * * 1\"\n    recipients: leadership\n    sections:\n      - key_metrics\n      - significant_incidents\n      - risk_posture\n      - recommendations\n      \n  - name: monthly_compliance_report\n    schedule: \"0 9 1 * *\"\n    recipients: compliance_team\n    sections:\n      - control_status\n      - audit_findings\n      - remediation_progress\n```\n\n## Best Practices\n\n1. **Defense in Depth**: Multiple detection layers\n2. **Least Privilege**: Minimize access rights\n3. **Log Everything**: Comprehensive audit trails\n4. **Automate Response**: Reduce MTTR\n5. **Regular Testing**: Validate controls\n6. **Threat Intelligence**: Stay informed\n7. **Incident Drills**: Practice response\n8. **Continuous Improvement**: Learn from incidents\n","# Security Monitoring\n\nComprehensive skill for security monitoring, threat detection, and incident response automation.\n\n## Core Architecture\n\n### Security Monitoring Stack\n\n```\nSECURITY MONITORING ARCHITECTURE:\n┌─────────────────────────────────────────────────────────┐\n│                     DATA SOURCES                         │\n├──────────┬──────────┬──────────┬──────────┬────────────┤\n│ Firewall │ Endpoint │ Cloud    │ Network  │ Application│\n│ Logs     │ Logs     │ Logs     │ Traffic  │ Logs       │\n└────┬─────┴────┬─────┴────┬─────┴────┬─────┴─────┬──────┘\n     │          │          │          │           │\n     └──────────┴──────────┴────┬─────┴───────────┘\n                                ▼\n┌─────────────────────────────────────────────────────────┐\n│                   LOG AGGREGATION                        │\n│              (SIEM \u002F Security Data Lake)                 │\n└────────────────────────┬────────────────────────────────┘\n                         ▼\n┌─────────────────────────────────────────────────────────┐\n│                   DETECTION ENGINE                       │\n│  • Rule-based Detection    • ML Anomaly Detection       │\n│  • Correlation Rules       • Threat Intelligence        │\n└────────────────────────┬────────────────────────────────┘\n                         ▼\n┌─────────────────────────────────────────────────────────┐\n│                   RESPONSE & ACTION                      │\n│  • Alerting        • Automated Response                 │\n│  • Ticketing       • Containment                        │\n└─────────────────────────────────────────────────────────┘\n```\n\n## Detection Rules\n\n### Rule Categories\n\n```yaml\ndetection_rules:\n  authentication:\n    - name: brute_force_login\n      description: \"Multiple failed login attempts\"\n      query: |\n        event.type == \"authentication\" AND\n        event.outcome == \"failure\" AND\n        COUNT(*) > 5 WITHIN 5 minutes\n        GROUP BY source.ip\n      severity: high\n      actions:\n        - create_alert\n        - block_ip_temporarily\n        \n    - name: impossible_travel\n      description: \"Login from geographically distant locations\"\n      query: |\n        event.type == \"authentication\" AND\n        event.outcome == \"success\" AND\n        geo_distance(prev_location, current_location) > 500km AND\n        time_diff \u003C 1 hour\n      severity: critical\n      actions:\n        - create_alert\n        - require_mfa_verification\n        - notify_user\n        \n  data_exfiltration:\n    - name: large_data_transfer\n      description: \"Unusual data egress volume\"\n      query: |\n        event.type == \"network\" AND\n        direction == \"outbound\" AND\n        bytes_transferred > 100MB WITHIN 1 hour\n        GROUP BY user.id\n      severity: medium\n      actions:\n        - create_alert\n        - capture_network_session\n        \n  malware:\n    - name: known_malware_hash\n      description: \"File matches known malware signature\"\n      query: |\n        event.type == \"file\" AND\n        file.hash.sha256 IN threat_intelligence.malware_hashes\n      severity: critical\n      actions:\n        - quarantine_file\n        - isolate_endpoint\n        - create_incident\n```\n\n### Correlation Rules\n\n```yaml\ncorrelation_rules:\n  - name: lateral_movement_detection\n    description: \"Detect potential lateral movement\"\n    events:\n      - type: authentication_success\n        from: internal_network\n      - type: process_execution\n        name: [\"psexec\", \"wmic\", \"powershell\"]\n        within: 5_minutes\n      - type: network_connection\n        to: different_internal_host\n        within: 10_minutes\n    severity: high\n    \n  - name: privilege_escalation_chain\n    description: \"Detect privilege escalation attempts\"\n    events:\n      - type: authentication\n        account_type: standard_user\n      - type: process_execution\n        elevated: true\n        within: 30_minutes\n      - type: account_modification\n        action: add_to_admin_group\n        within: 1_hour\n    severity: critical\n```\n\n## Alert Management\n\n### Alert Configuration\n\n```yaml\nalert_config:\n  severity_levels:\n    critical:\n      response_time: 15_minutes\n      notifications:\n        - pagerduty: security_oncall\n        - slack: \"#security-critical\"\n        - email: security-team@company.com\n      auto_escalation: 30_minutes\n      \n    high:\n      response_time: 1_hour\n      notifications:\n        - slack: \"#security-alerts\"\n        - email: security-team@company.com\n        \n    medium:\n      response_time: 4_hours\n      notifications:\n        - slack: \"#security-alerts\"\n        \n    low:\n      response_time: 24_hours\n      notifications:\n        - ticket_only: true\n        \n  deduplication:\n    enabled: true\n    window: 1_hour\n    key_fields:\n      - rule_id\n      - source.ip\n      - destination.ip\n```\n\n### Alert Template\n\n```yaml\nalert_template:\n  title: \"[{{severity}}] {{rule_name}}\"\n  \n  body: |\n    ## Security Alert\n    \n    **Rule:** {{rule_name}}\n    **Severity:** {{severity}}\n    **Time:** {{timestamp}}\n    \n    ### Details\n    - **Source IP:** {{source.ip}}\n    - **Source User:** {{user.name}}\n    - **Destination:** {{destination.ip}}\n    - **Action:** {{event.action}}\n    \n    ### Context\n    {{event_context}}\n    \n    ### Recommended Actions\n    {{#each recommended_actions}}\n    - {{this}}\n    {{\u002Feach}}\n    \n    ### Related Events\n    {{related_events_link}}\n```\n\n## Incident Response\n\n### Incident Workflow\n\n```\nINCIDENT RESPONSE WORKFLOW:\n┌─────────────────┐\n│    Detection    │\n│  (Alert Fired)  │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│     Triage      │\n│  - Validate     │\n│  - Classify     │\n│  - Prioritize   │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│   Containment   │\n│  - Isolate      │\n│  - Block        │\n│  - Preserve     │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│  Investigation  │\n│  - Collect      │\n│  - Analyze      │\n│  - Correlate    │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│   Eradication   │\n│  - Remove       │\n│  - Patch        │\n│  - Harden       │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│    Recovery     │\n│  - Restore      │\n│  - Verify       │\n│  - Monitor      │\n└────────┬────────┘\n         ▼\n┌─────────────────┐\n│  Post-Incident  │\n│  - Document     │\n│  - Review       │\n│  - Improve      │\n└─────────────────┘\n```\n\n### Playbook Automation\n\n```yaml\nplaybooks:\n  - name: ransomware_response\n    trigger:\n      alert_type: ransomware_detected\n    steps:\n      - name: isolate_endpoint\n        action: network_isolate\n        target: \"{{affected_host}}\"\n        \n      - name: disable_account\n        action: disable_ad_account\n        target: \"{{user.name}}\"\n        \n      - name: preserve_evidence\n        action: capture_memory_image\n        target: \"{{affected_host}}\"\n        \n      - name: notify_stakeholders\n        action: send_notification\n        channels:\n          - security_team\n          - it_leadership\n          - legal_if_needed\n          \n      - name: create_incident\n        action: create_ticket\n        priority: critical\n        template: ransomware_incident\n        \n  - name: phishing_response\n    trigger:\n      alert_type: phishing_reported\n    steps:\n      - name: analyze_email\n        action: extract_iocs\n        extract:\n          - sender_address\n          - urls\n          - attachments\n          \n      - name: check_recipients\n        action: query_email_logs\n        find: all_recipients\n        \n      - name: block_sender\n        action: add_to_blocklist\n        target: \"{{sender_address}}\"\n        \n      - name: remove_emails\n        action: delete_from_mailboxes\n        target: all_recipients\n```\n\n## Compliance Monitoring\n\n### Compliance Frameworks\n\n```yaml\ncompliance_checks:\n  pci_dss:\n    - requirement: \"10.2.1\"\n      description: \"Log all access to cardholder data\"\n      query: |\n        SELECT * FROM audit_logs\n        WHERE data_classification = 'cardholder'\n        AND timestamp > NOW() - INTERVAL '24 hours'\n      expected: all_access_logged\n      \n    - requirement: \"10.6.1\"\n      description: \"Review logs daily\"\n      check: daily_log_review_completed\n      \n  hipaa:\n    - requirement: \"164.312(b)\"\n      description: \"Audit controls\"\n      checks:\n        - audit_logging_enabled\n        - log_retention_6_years\n        - tamper_protection\n        \n  soc2:\n    - control: \"CC6.1\"\n      description: \"Logical access security\"\n      checks:\n        - mfa_enabled\n        - password_policy_enforced\n        - access_reviews_quarterly\n```\n\n### Compliance Dashboard\n\n```\nCOMPLIANCE STATUS DASHBOARD\n═══════════════════════════════════════\n\nPCI-DSS:      ████████████░░░░ 92% ✓\nHIPAA:        ██████████████░░ 98% ✓\nSOC 2:        █████████████░░░ 95% ✓\nGDPR:         ████████████████ 100% ✓\n\nFINDINGS BY SEVERITY:\nCritical  ░░░░░░░░░░░░░░░░ 0\nHigh      ██░░░░░░░░░░░░░░ 3\nMedium    ████░░░░░░░░░░░░ 8\nLow       ██████░░░░░░░░░░ 15\n\nUPCOMING DEADLINES:\n• Jan 30: Quarterly access review\n• Feb 15: Penetration test scheduled\n• Feb 28: Annual audit prep\n```\n\n## Security Metrics\n\n### KPI Dashboard\n\n```\nSECURITY OPERATIONS METRICS\n═══════════════════════════════════════\n\nDETECTION:\nMTTD (Mean Time to Detect): 4.2 hours\nAlert Volume: 1,234\u002Fday\nTrue Positive Rate: 78%\n\nRESPONSE:\nMTTR (Mean Time to Respond): 1.8 hours\nIncidents Resolved: 23\u002Fweek\nSLA Compliance: 96%\n\nCOVERAGE:\nAssets Monitored: 2,456\u002F2,500 (98%)\nLog Sources: 45 active\nDetection Rules: 234 active\n\nTHREAT LANDSCAPE:\nBlocked Attacks: 12,456\u002Fmonth\nVulnerabilities: 89 open\nPatch Compliance: 94%\n```\n\n### Reporting\n\n```yaml\nreports:\n  - name: daily_security_briefing\n    schedule: \"0 8 * * *\"\n    recipients: security_team\n    sections:\n      - overnight_alerts\n      - active_incidents\n      - threat_intelligence_updates\n      \n  - name: weekly_executive_summary\n    schedule: \"0 9 * * 1\"\n    recipients: leadership\n    sections:\n      - key_metrics\n      - significant_incidents\n      - risk_posture\n      - recommendations\n      \n  - name: monthly_compliance_report\n    schedule: \"0 9 1 * *\"\n    recipients: compliance_team\n    sections:\n      - control_status\n      - audit_findings\n      - remediation_progress\n```\n\n## Best Practices\n\n1. **Defense in Depth**: Multiple detection layers\n2. **Least Privilege**: Minimize access rights\n3. **Log Everything**: Comprehensive audit trails\n4. **Automate Response**: Reduce MTTR\n5. **Regular Testing**: Validate controls\n6. **Threat Intelligence**: Stay informed\n7. **Incident Drills**: Practice response\n8. **Continuous Improvement**: Learn from incidents\n",{"mcp":24,"name":5,"tags":31,"input":37,"author":42,"models":43,"output":47,"version":52,"category":32,"languages":53,"department":32,"description":7,"capabilities":55,"related_skills":60},{"tools":25,"server":30},[26,27,28,29],"siem_query","alert_create","incident_manage","compliance_check","security-mcp",[32,33,34,35,36],"security","monitoring","siem","incident-response","compliance",[38,39,40,41],"Security logs","Alert rules","Incident data","Compliance requirements","Claude Office Skills",[44,45,46],"claude-3-opus","claude-3-sonnet","gpt-4",[48,49,50,51],"Security alerts","Incident reports","Compliance dashboards","Threat intelligence","1.0.0",[54],"en",[56,57,58,59],"Threat detection and alerting","Incident response automation","Log analysis and correlation","Compliance monitoring",[61,62,63],"devops-automation","log-analysis","compliance-audit","main","9c4c7d5cd2813a8936bf2c9fdb174ea883b85a11","security-monitoring",101,"https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills","2026-01-31 22:03:56",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add claude-office-skills\u002Fskills --skill \"Security Monitoring\"",{"tool":77,"command":78},"bunx","bunx skills add claude-office-skills\u002Fskills --skill \"Security Monitoring\"",{"tool":80,"command":81},"pnpm","pnpm dlx skills add claude-office-skills\u002Fskills --skill \"Security Monitoring\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fsecurity-monitoring\u002FSKILL.md",true,[],[86,92,99,106,113,120],{"skillNo":87,"name":61,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M72A0X7X4TWS4ZWTEK8TJEC8","DevOps and IT Ops automation - CI\u002FCD, monitoring, incident management, and infrastructure workflows","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdevops-automation\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":19},"01M72A0VPXF4Q5F48TPDG6S10Q","dev-slides",">","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdev-slides\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":19},"01M72A0Q1T0KN60CR3PAD93J6T","deep-research","Conduct comprehensive research on any topic. Synthesize information from multiple angles, provide structured analysis, and generate detailed research reports.","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdeep-research\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":19},"01M72A0KWAYEWQJMDRGC0WTT7V","dcf-valuation","Build Discounted Cash Flow (DCF) valuation models. Calculate intrinsic value with customizable assumptions. Generate professional valuation reports.","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdcf-valuation\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":19},"01M72A0GVWRZ3HZNXMW3RB5CF9","Database Sync","Automate database synchronization, replication, migration, and cross-platform data integration","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdatabase-sync\u002FSKILL.md",[],[],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":19},"01M72A0E16K862EDP0QYEAC9HJ","data-pipeline","Data pipeline and ETL automation - extract, transform, load workflows for data integration and analytics","https:\u002F\u002Fgithub.com\u002Fclaude-office-skills\u002Fskills\u002Fblob\u002Fmain\u002Fdata-pipeline\u002FSKILL.md",[],[]]