Skill Catalog
Browse 5,478 curated AI agent skills. No account needed.
Implementing Ics Firewall With Tofino
Deploy and configure Tofino industrial firewalls from Belden/Hirschmann to protect SCADA systems and PLCs using deep packet inspection for OT protocols including Modbus, EtherNet/IP, OPC, and S7comm, enforcing granular access control between ICS security zones.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ics-firewall-with-tofino
Implementing Identity Governance with SailPoint
Deploy SailPoint IdentityNow or IdentityIQ for identity governance and administration. Covers identity lifecycle
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-identity-governance-with-sailpoint
Implementing Identity Verification For Zero Trust
Implement continuous identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with the CISA Zero Trust Maturity Model.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-identity-verification-for-zero-trust
Implementing Iec 62443 Security Zones
This skill covers designing and implementing security zones and conduits for industrial automation and control systems (IACS) per IEC 62443-3-2. It addresses zone partitioning based on risk assessment, assigning Security Level targets (SL-T), designing conduit security controls, implementing microsegmentation with industrial firewalls, and validating zone architecture through traffic analysis and penetration testing against the Purdue Reference Model.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-iec-62443-security-zones
Implementing Image Provenance Verification With Cosign
Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-image-provenance-verification-with-cosign
Implementing Immutable Backup With Restic
Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification via restic check --read-data, snapshot retention policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion or encryption by ransomware actors.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-immutable-backup-with-restic
Implementing Infrastructure As Code Security Scanning
This skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses detecting misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before deployment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-infrastructure-as-code-security-scanning
Implementing Iso 27001 Information Security Management
ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-iso-27001-information-security-management
Implementing Just In Time Access Provisioning
Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access only when needed. This skill covers JIT architecture design, approval workflo
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-just-in-time-access-provisioning
Implementing JWT Signing And Verification
JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-jwt-signing-and-verification
Implementing Kubernetes Network Policy With Calico
Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-kubernetes-network-policy-with-calico
Implementing Kubernetes Pod Security Standards
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-kubernetes-pod-security-standards
Implementing LLM Guardrails For Security
Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII detection and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, enforcing topic boundaries) and model outputs (detecting hallucinations, filtering toxic content, validating JSON schema compliance). Activates for requests involving LLM output validation, AI content filtering, guardrail implementation, or LLM safety enforcement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-llm-guardrails-for-security
Implementing LLMs Litgpt
Implements and trains LLMs using Lightning AI's LitGPT with 20+ pretrained architectures (Llama, Gemma, Phi, Qwen, Mistral). Use when need clean model implementations, educational understanding of architectures, or production fine-tuning with LoRA/QLoRA. Single-file implementations, no abstraction layers.
by Orchestra-Research/AI-Research-SKILLs / 01-model-architecture/litgpt
Implementing Log Forwarding With Fluentd
Configure Fluentd and Fluent Bit for centralized log aggregation, routing, filtering, and enrichment across distributed infrastructure
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-log-forwarding-with-fluentd
Implementing Log Integrity With Blockchain
Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes. Implements log ingestion, chain verification, tamper detection with pinpoint identification, and periodic checkpoint anchoring to external timestamping services.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-log-integrity-with-blockchain
Implementing Memory Protection With Dep Aslr
Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-memory-protection-with-dep-aslr
Implementing Microsegmentation With Guardicore
Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-microsegmentation-with-guardicore
Implementing Mimecast Targeted Attack Protection
Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect to defend against advanced phishing and spearphishing attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-mimecast-targeted-attack-protection
Implementing Mitre Attack Coverage Mapping
Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-mitre-attack-coverage-mapping
Implementing Mobile Application Management
Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-mobile-application-management
Implementing mTLS for Zero Trust Services
'Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-mtls-for-zero-trust-services
Implementing Nerc Cip Compliance Controls
This skill covers implementing North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) compliance controls for Bulk Electric System (BES) cyber systems. It addresses asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), supply chain risk management (CIP-013), and the 2025 updates including mandatory MFA for remote access and expanded low-impact asset requirements.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-nerc-cip-compliance-controls
Implementing Network Access Control
Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configurations to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-access-control
Implementing Network Access Control With Cisco Ise
Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-access-control-with-cisco-ise
Implementing Network Deception With Honeypots
Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-deception-with-honeypots
Implementing Network Intrusion Prevention With Suricata
Deploy and configure Suricata as a network intrusion prevention system with custom rules, Emerging Threats rulesets, and inline traffic inspection for real-time threat blocking.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-intrusion-prevention-with-suricata
Implementing Network Policies For Kubernetes
Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pods, namespaces, and external endpoints. Combined with CNI plu
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-policies-for-kubernetes
Implementing Network Segmentation For Ot
This skill covers implementing network segmentation in Operational Technology environments using VLANs, industrial firewalls, data diodes, and software-defined networking. It addresses the Purdue Model-based segmentation strategy, migration from flat networks to segmented architectures without disrupting operations, configuring OT-aware firewalls with industrial protocol deep packet inspection, and validating segmentation effectiveness through traffic analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-segmentation-for-ot
Implementing Network Segmentation With Firewall Zones
Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-segmentation-with-firewall-zones
Implementing Network Traffic Analysis with Arkime
Deploy and query Arkime (formerly Moloch) for full packet capture network traffic analysis. Uses the Arkime API
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-traffic-analysis-with-arkime
Implementing Network Traffic Baselining
Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-network-traffic-baselining
Implementing Next Generation Firewall With Palo Alto
Configure and deploy Palo Alto Networks next-generation firewalls with App-ID, User-ID, zone-based policies, SSL decryption, and threat prevention profiles for enterprise network security.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-next-generation-firewall-with-palo-alto
Implementing Opa Gatekeeper For Policy Enforcement
Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-opa-gatekeeper-for-policy-enforcement
Implementing Ot Incident Response Playbook
Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ot-incident-response-playbook
Implementing Ot Network Traffic Analysis With Nozomi
Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across industrial control systems without disrupting operations, leveraging behavioral anomaly detection and protocol-aware monitoring.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ot-network-traffic-analysis-with-nozomi
Implementing PAM for Database Access
Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-pam-for-database-access
Implementing Passwordless Authentication With Fido2
Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentica
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-passwordless-authentication-with-fido2
Implementing Passwordless Auth With Microsoft Entra
Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-passwordless-auth-with-microsoft-entra
Implementing Patch Management For Ot Systems
This skill covers implementing a structured patch management program for OT/ICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-patch-management-for-ot-systems
Implementing Patch Management Workflow
Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patc
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-patch-management-workflow
Implementing Pci Dss Compliance Controls
PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-pci-dss-compliance-controls
Implementing Pod Security Admission Controller
Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-pod-security-admission-controller
Implementing Policy As Code With Open Policy Agent
This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-policy-as-code-with-open-policy-agent
Implementing Privileged Access Management With Cyberark
Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure. This skill covers vault architecture, session isolation, c
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-privileged-access-management-with-cyberark
Implementing Privileged Access Workstation
Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-privileged-access-workstation
Implementing Privileged Session Monitoring
Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Activates for requests involving privileged session recording, PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, or compliance session auditing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-privileged-session-monitoring
Implementing Proofpoint Email Security Gateway
Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-proofpoint-email-security-gateway
Implementing Purdue Model Network Segmentation
Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model to separate industrial control system networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise, enforcing strict traffic control between OT and IT domains.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-purdue-model-network-segmentation
Implementing Ransomware Backup Strategy
Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO requirements, implements backup credential isolation to prevent ransomware from compromising backup infrastructure, and establishes automated restore testing. Activates for requests involving ransomware backup planning, backup resilience, air-gapped backup design, or backup recovery point objective configuration.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ransomware-backup-strategy
Implementing Ransomware Kill Switch Detection
Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing. Activates for requests involving ransomware kill switch analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution guard detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ransomware-kill-switch-detection
Implementing Rapid7 Insightvm For Scanning
Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-rapid7-insightvm-for-scanning
Implementing Rbac Hardening For Kubernetes
Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-rbac-hardening-for-kubernetes
Implementing RSA Key Pair Management
RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-rsa-key-pair-management
Implementing Runtime Application Self Protection
Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-runtime-application-self-protection
Implementing Runtime Security With Tetragon
Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-runtime-security-with-tetragon
Implementing Saml Sso With Okta
Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, a
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-saml-sso-with-okta
Implementing Scim Provisioning With Okta
Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-scim-provisioning-with-okta
Implementing Secret Scanning With Gitleaks
This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-secret-scanning-with-gitleaks
Implementing Secrets Management With Vault
This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-secrets-management-with-vault
Implementing Secrets Scanning In CI CD
Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-secrets-scanning-in-ci-cd
Implementing Security Chaos Engineering
Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-security-chaos-engineering
Implementing Security Information Sharing With Stix2
Create, validate, and share STIX 2.1 threat intelligence objects using the stix2 Python library. Covers indicators, malware, campaigns, relationships, bundles, and TAXII 2.1 publishing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-security-information-sharing-with-stix2
Implementing Security Monitoring With Datadog
Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment, log source ingestion, detection rule creation, security dashboards, and automated notification workflows. Activates for requests involving Datadog security setup, Cloud SIEM configuration, CSM threat detection, or security monitoring dashboards.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-security-monitoring-with-datadog
Implementing Semgrep For Custom Sast Rules
Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-semgrep-for-custom-sast-rules
Implementing Siem Correlation Rules For Apt
Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-siem-correlation-rules-for-apt
Implementing Siem Use Cases For Detection
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-siem-use-cases-for-detection
Implementing Siem Use Case Tuning
Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and Elastic
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-siem-use-case-tuning
Implementing Sigstore For Software Signing
Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts. The practitioner configures OIDC-based identity binding, verifies signing events against the Rekor transparency log, and integrates signing workflows into CI/CD pipelines. Activates for requests involving software supply chain signing, keyless container signing, Sigstore deployment, or artifact provenance verification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-sigstore-for-software-signing
Implementing Soar Automation With Phantom
Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-soar-automation-with-phantom
Implementing SOAR Playbook for Phishing
Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-soar-playbook-for-phishing
Implementing Soar Playbook With Palo Alto Xsoar
Implement automated incident response playbooks in Cortex XSOAR to orchestrate security workflows across SOC tools and reduce manual response time.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-soar-playbook-with-palo-alto-xsoar
Implementing Stix Taxii Feed Integration
STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-stix-taxii-feed-integration
Implementing Supply Chain Security With In Toto
Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-supply-chain-security-with-in-toto
Implementing Syslog Centralization With Rsyslog
Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-syslog-centralization-with-rsyslog
Implementing Taxii Server With Opentaxii
Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange between organizations.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-taxii-server-with-opentaxii
Implementing Threat Intelligence Lifecycle Management
Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-threat-intelligence-lifecycle-management
Implementing Threat Modeling With Mitre Attack
Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-threat-modeling-with-mitre-attack
Implementing Ticketing System For Incidents
Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-ticketing-system-for-incidents
Implementing Usb Device Control Policy
Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-usb-device-control-policy
Implementing Velociraptor For Ir Collection
Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-velociraptor-for-ir-collection
Implementing Vulnerability Management With Greenbone
Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-vulnerability-management-with-greenbone
Implementing Vulnerability Remediation Sla
Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-vulnerability-remediation-sla
Implementing Vulnerability Sla Breach Alerting
Build automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-vulnerability-sla-breach-alerting
Implementing Web Application Logging With Modsecurity
Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage with operational stability. Activates for requests involving WAF configuration, ModSecurity rule tuning, web application audit logging, or CRS deployment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-web-application-logging-with-modsecurity
Implementing Zero Knowledge Proof For Authentication
Zero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge of a secret (such as a password or private key) without revealing the secret itself. This skill implements the Schnorr identificati
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-knowledge-proof-for-authentication
Implementing Zero Standing Privilege with CyberArk
Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-standing-privilege-with-cyberark
Implementing Zero Trust DNS With Nextdns
Implement NextDNS as a zero trust DNS filtering layer with encrypted resolution, threat intelligence blocking, privacy protection, and organizational policy enforcement across all endpoints.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-dns-with-nextdns
Implementing Zero Trust For SaaS Applications
Implementing zero trust access controls for SaaS applications using CASB, SSPM, conditional access policies, OAuth app governance, and session controls to enforce identity verification, device compliance, and data protection for cloud-hosted services.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-for-saas-applications
Implementing Zero Trust In Cloud
This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-in-cloud
Implementing Zero Trust Network Access
Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-network-access
Implementing Zero Trust Network Access With Zscaler
Implement Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-network-access-with-zscaler
Implementing Zero Trust with BeyondCorp
Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-with-beyondcorp
Implementing Zero Trust With Hashicorp Boundary
Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.
by mukul975/Anthropic-Cybersecurity-Skills / skills/implementing-zero-trust-with-hashicorp-boundary
Import Art
Places album art files in the correct audio and content directory locations. Use when the user has generated or downloaded album artwork that needs to be saved.
by bitwize-music-studio/claude-ai-music-skills / skills/import-art
Import Audio Skill
Moves audio files to the correct album location with proper path structure. Use when the user has downloaded WAV files from Suno or other sources that need to be organized.
by bitwize-music-studio/claude-ai-music-skills / skills/import-audio
Import Infrastructure As Code
Import existing Azure resources into Terraform using Azure CLI discovery and Azure Verified Modules (AVM). Use when asked to reverse-engineer live Azure infrastructure, generate Infrastructure as Code from existing subscriptions/resource groups/resource IDs, map dependencies, derive exact import addresses from downloaded module source, prevent configuration drift, and produce AVM-based Terraform files ready for validation and planning across any Azure resource type.
by github/awesome-copilot / skills/import-infrastructure-as-code
Import Track Skill
Moves track markdown files to the correct album location. Use when the user has track files in Downloads or other locations that need to be placed in an album.
by bitwize-music-studio/claude-ai-music-skills / skills/import-track
Improve Codebase Architecture
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
by mattpocock/skills / skills/engineering/improve-codebase-architecture
Imsg
iMessage/SMS CLI for listing chats, history, and sending messages via Messages.app.
by openclaw/openclaw / skills/imsg