oyi77/1ai-skills - 第 4 页

implementing-passwordless-authentication-with-fido2

Use when deploying FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentica

原文语言：英语

implementing-patch-management-for-ot-systems

Use when this skill covers implementing a structured patch management program for OT/ICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch…

原文语言：英语

implementing-policy-as-code-with-open-policy-agent

Use when this skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing…

原文语言：英语

implementing-privileged-access-management-with-cyberark

Use when deploying CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure. This skill covers vault architecture, session isolation, c

原文语言：英语

implementing-privileged-session-monitoring

Use when implementing privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives. Covers session recording configuration, keystroke…

原文语言：英语

implementing-ransomware-backup-strategy

Use when designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO…

原文语言：英语

implementing-rsa-key-pair-management

Use when RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating,

原文语言：英语

implementing-saml-sso-with-okta

Use when implementing SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, a

原文语言：英语

implementing-scim-provisioning-with-okta

Use when implementing automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.

原文语言：英语

implementing-secret-scanning-with-gitleaks

Use when this skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline…

原文语言：英语

implementing-secrets-management-with-vault

Use when this skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes…

原文语言：英语

implementing-security-information-sharing-with-stix2

Use when creating, validating, and sharing STIX 2.1 threat intelligence objects using the stix2 Python library. Covers indicators, malware, campaigns, relationships, bundles, and TAXII 2.1 publishing.

原文语言：英语

implementing-security-monitoring-with-datadog

Use when implementing security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment,…

原文语言：英语

implementing-soar-playbook-for-phishing

Use when automating phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger playbooks

原文语言：英语

implementing-soar-playbook-with-palo-alto-xsoar

Use when implementing automated incident response playbooks in Cortex XSOAR to orchestrate security workflows across SOC tools and reduce manual response time.

原文语言：英语

implementing-stix-taxii-feed-integration

Use when STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.

原文语言：英语

implementing-syslog-centralization-with-rsyslog

Use when configuring rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and…

原文语言：英语

implementing-taxii-server-with-opentaxii

Use when deploying and configuring an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange between organizations.

原文语言：英语

implementing-vulnerability-sla-breach-alerting

Use when building automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.

原文语言：英语

implementing-web-application-logging-with-modsecurity

Use when configuring ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tuning rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst…

原文语言：英语

implementing-zero-trust-in-cloud

Use when this skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification,…

原文语言：英语

integrating-dast-with-owasp-zap-in-pipeline

Use when this skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan…

原文语言：英语

integrating-sast-into-github-actions-pipeline

Use when this skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false…

原文语言：英语

managing-cloud-identity-with-okta

Use when this skill covers implementing Okta as a centralized identity provider for cloud environments, configuring SSO integration with AWS, Azure, and GCP, deploying phishing- resistant MFA with Okta FastPass, managing lifecycle automation for user…

原文语言：英语

performing-access-review-and-certification

Use when conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p

原文语言：英语

performing-api-security-testing-with-postman

Use when using Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates…

原文语言：英语

performing-automated-malware-analysis-with-cape

Use when deploying and operating CAPEv2 sandbox for automated malware analysis with behavioral monitoring, payload extraction, configuration parsing, and anti-evasion capabilities.

原文语言：英语

performing-aws-account-enumeration-with-scout-suite

Use when performing comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports.

原文语言：英语

performing-binary-exploitation-analysis

Use when analyzing binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments.

原文语言：英语

performing-cloud-native-threat-hunting-with-aws-detective

Use when hunting for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.

原文语言：英语

performing-container-image-hardening

Use when this skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure…

原文语言：英语

performing-entitlement-review-with-sailpoint-iiq

Use when performing entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows.…

原文语言：英语

performing-firmware-extraction-with-binwalk

Use when performing firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions,…

原文语言：英语

performing-firmware-malware-analysis

Use when analyzing firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit…

原文语言：英语

performing-fuzzing-with-aflplusplus

Use when performing coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input…

原文语言：英语

performing-indicator-lifecycle-management

Use when indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f

原文语言：英语

performing-kubernetes-cis-benchmark-with-kube-bench

Use when auditing Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.

原文语言：英语

performing-malware-triage-with-yara

Use when performing rapid malware triage and classification using YARA rules to match file patterns, strings, byte sequences, and structural characteristics against known malware families and suspicious indicators. Covers rule writing, scanning, and…

原文语言：英语

performing-mobile-app-certificate-pinning-bypass

Use when bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustManager, NSURLSession, and third-party pinning library bypass techniques…

原文语言：英语

performing-network-traffic-analysis-with-tshark

Use when automating network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files

原文语言：英语