Claude Skills by chrishuffman5

Expert agent for StackHawk CI/CD-native DAST. Covers stackhawk.yml configuration, HawkScan Docker runner, authenticated scanning, API scanning, GitHub/GitLab/Jenkins/CircleCI integration, and developer-focused DAST workflows. WHEN: \"StackHawk\", \"HawkScan\", \"stackhawk.yml\", \"hawkscan\", \"StackHawk DAST\", \"hawk scan\", \"stackhawk API scan\".

Expert agent for Sublime Security. Covers MQL (Message Query Language), YAML detection rules, programmable email security, open-source community detections, and API-based M365/Google Workspace integration. WHEN: \"Sublime Security\", \"Sublime\", \"MQL\", \"Message Query Language\", \"email detection rules\", \"programmable email security\", \"Sublime YAML rules\", \"open source email detection\".

Expert agent for Suricata IDS/IPS/NSM. Covers rule writing, EVE JSON logging, AF_PACKET/DPDK capture, protocol parsers, JA3/JA4 fingerprinting, file extraction, datasets, suricata-update, performance tuning, and IPS inline mode. WHEN: \"Suricata\", \"EVE JSON\", \"suricata rule\", \"suricata-update\", \"ET rules\", \"Emerging Threats\", \"JA3\", \"JA4\", \"AF_PACKET\", \"Suricata IPS\", \"suricata.yaml\", \"threshold.config\".

Expert agent for Symantec DLP (Broadcom). Covers Enforce Platform, Network Monitor/Prevent, Endpoint Discover/Prevent, Indexed Document Matching, Exact Data Matching, Vector Machine Learning, Cloud Detection Service, and CASB integration. WHEN: \"Symantec DLP\", \"Broadcom DLP\", \"Vontu\", \"Network Monitor\", \"Network Prevent\", \"Endpoint Prevent\", \"IDM\", \"VML\", \"Enforce Platform\", \"Cloud Detection Service\".

Expert agent for Sysdig Secure CNAPP platform. Covers Falco-based runtime security, image scanning with in-use context, Kubernetes posture (KSPM), CDR, identity/network security, GRC, risk prioritization using runtime context, and Sysdig Monitor observability. WHEN: \"Sysdig\", \"Sysdig Secure\", \"Sysdig runtime\", \"Sysdig image scanning\", \"Sysdig KSPM\", \"Sysdig CDR\", \"Sysdig in use\", \"Sysdig Falco\", \"Sysdig posture\", \"Sysdig Monitor\", \"Sysdig agent\".

Expert agent for Tenable Nessus, Tenable.io, and Tenable One. Covers scanner deployment, credentialed scan policies, plugin management, compliance auditing, VPR/EPSS prioritization, Nessus Agent configuration, and Tenable One exposure management. WHEN: \"Tenable\", \"Nessus\", \"Tenable.io\", \"Tenable One\", \"VPR\", \"Nessus agent\", \"plugin families\", \"credentialed scan\", \"Tenable SC\", \"exposure management\".

Expert routing agent for threat intelligence. Covers intelligence lifecycle, strategic/tactical/operational/technical intel, IOCs vs TTPs, STIX/TAXII, TLP 2.0, kill chain, diamond model, and threat actor taxonomy. Routes to Recorded Future, Mandiant, ThreatConnect, and MISP agents. WHEN: \"threat intelligence\", \"threat intel\", \"IOC\", \"TTP\", \"STIX\", \"TAXII\", \"TLP\", \"threat actor\", \"APT\", \"threat feed\", \"intelligence lifecycle\", \"diamond model\". Do NOT use for platform-sp...

Expert agent for ThreatConnect TIP and SOAR platform. Covers CAL scoring, ThreatConnect Intelligence feeds, visual playbook automation, case management, indicator management, groups and associations, and STIX/TAXII integration. WHEN: \"ThreatConnect\", \"TC\", \"CAL\", \"Collective Analytics Layer\", \"TCI\", \"ThreatConnect Intelligence\", \"TC playbooks\", \"TC case management\", \"Dataminr\".

Expert agent for Tines security automation. Provides deep expertise in no-code story building, action types (HTTP, Transform, Trigger, Event), team edition (free tier), credential management, story library, and vendor-agnostic security workflow design. WHEN: \"Tines\", \"Tines story\", \"Tines automation\", \"no-code SOAR\", \"Tines action\", \"Tines trigger\", \"Tines transform\", \"Tines free\", \"Tines team edition\".

Expert agent for Torq hyperautomation platform. Provides deep expertise in AI-powered case management, visual workflow builder, integrations marketplace, SOC Copilot, no-code/low-code automation, event-driven triggers, and enterprise-grade security orchestration. WHEN: \"Torq\", \"Torq automation\", \"Torq workflow\", \"hyperautomation\", \"Torq SOC Copilot\", \"Torq integration\", \"Torq playbook\", \"Torq case management\".

Expert agent for Vanta compliance automation. Covers 400+ integrations, 35+ frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR), automated evidence collection, continuous monitoring, trust reports, vendor risk management, AI policy agent, and custom frameworks. WHEN: \"Vanta\", \"Vanta SOC 2\", \"Vanta ISO 27001\", \"Vanta integrations\", \"Vanta trust report\", \"Vanta vendor risk\", \"Vanta AI policy\", \"Vanta custom framework\".

Expert agent for HashiCorp Vault across all editions (Community, Enterprise, HCP). Covers seal/unseal, secret engines (KV, database, PKI, transit), auth methods (AppRole, Kubernetes, OIDC, AWS), policies, Vault Agent, Vault Secrets Operator, and replication. WHEN: \"HashiCorp Vault\", \"Vault seal\", \"Vault unseal\", \"secret engine\", \"AppRole\", \"Vault Agent\", \"Vault Operator\", \"VSO\", \"transit encryption\", \"Vault PKI\".

Expert agent for Veeam Data Platform (VBR v12/v13). Covers backup infrastructure architecture, hardened Linux repositories, immutable backups, SureBackup verification, Secure Restore, 4-eyes authorization, SOBR, and ransomware resilience configuration. WHEN: \"Veeam\", \"VBR\", \"Veeam Backup & Replication\", \"hardened Linux repository\", \"SureBackup\", \"Secure Restore\", \"SOBR\", \"Veeam ONE\", \"Veeam Recovery Orchestrator\", \"4-eyes authorization\".

Expert agent for Venafi / CyberArk Machine Identity Security. Covers TLS Protect (on-prem + cloud), CodeSign Protect, SSH Protect, certificate lifecycle management, machine identity policy, SPIFFE/SPIRE integration, and CyberArk acquisition context. WHEN: \"Venafi\", \"TLS Protect\", \"CodeSign Protect\", \"machine identity\", \"Venafi Trust Protection Platform\", \"Venafi Cloud\", \"Venafi Firefly\", \"certificate discovery\", \"MSSP\", \"certificate policy enforcement\".

Expert agent for Veracode application security platform. Covers binary/bytecode analysis, Policy Scan, Pipeline Scan, Veracode Fix AI remediation, SCA, DAST, eLearning, and compliance reporting. WHEN: \"Veracode\", \"Veracode policy scan\", \"Veracode pipeline scan\", \"Veracode upload\", \"Veracode Fix\", \"Veracode eLearning\", \"binary analysis\", \"bytecode scanning\".

Subdomain routing agent for Vulnerability Management and Attack Surface Management. Covers VM programs, scanner operations, risk scoring (CVSS/EPSS/VPR), remediation workflows, SLA tracking, CNAPP platforms, and EASM tools. WHEN: \"vulnerability management\", \"vuln scan\", \"CVE\", \"CVSS\", \"EPSS\", \"patch prioritization\", \"attack surface\", \"EASM\", \"CNAPP\", \"CSPM\", \"exposure management\". Do NOT use for platform-specific questions -- use the `qualys`, `tenable`, `rapid7`, `snyk`...

Expert routing agent for Web Application Firewalls (WAF/WAAP). Covers WAF concepts, rule management, false positive tuning, DDoS mitigation, bot defense, API protection, and deployment architectures. Routes to Cloudflare WAF, AWS WAF, Akamai App & API Protector, and F5 Advanced WAF. WHEN: \"WAF\", \"web application firewall\", \"WAAP\", \"managed rules\", \"rate limiting\", \"bot protection\", \"DDoS\", \"rule tuning\", \"false positive WAF\", \"IP reputation\". Do NOT use for vendor-specific...

Expert agent for Wazuh open-source EDR/SIEM platform. Covers agent deployment, ossec.conf configuration, FIM, SCA, active response, custom rules and decoders, vulnerability detection, compliance (PCI DSS, HIPAA, GDPR), cluster deployment, and Wazuh indexer/dashboard setup. WHEN: \"Wazuh\", \"OSSEC\", \"open-source EDR\", \"FIM\", \"SCA\", \"Wazuh manager\", \"Wazuh agent\", \"ossec.conf\", \"active response\", \"Wazuh indexer\".

Expert agent for Wiz cloud security platform. Covers agentless CNAPP, Security Graph, toxic combinations, attack path analysis, CSPM/CWPP/CIEM/DSPM/CDR, Wiz Code shift-left, Wiz Defend runtime, AI-SPM, and multi-cloud configuration. WHEN: \"Wiz\", \"Wiz Security Graph\", \"toxic combination\", \"Wiz attack path\", \"Wiz CSPM\", \"Wiz CWPP\", \"Wiz Code\", \"Wiz Defend\", \"AI-SPM Wiz\", \"Wiz policy\", \"Wiz connector\".

Expert agent for Palo Alto Cortex Xpanse EASM. Covers internet-wide scanning, exposure prioritization, automated remediation via XSOAR/Cortex, Xpanse API, and integration with Cortex XDR and Prisma Cloud. WHEN: \"Xpanse\", \"Cortex Xpanse\", \"Palo Alto EASM\", \"Xpanse attack surface\", \"internet scanning Palo Alto\", \"Xpanse automated remediation\".

Expert agent for Palo Alto Cortex XSIAM. Provides deep expertise in the converged SIEM+SOAR+XDR+ASM platform, XQL query development, AI-driven SOC operations, Automation Center playbooks, Investigation Graph, data integration broker, and ML-based correlation and clustering. WHEN: \"XSIAM\", \"Cortex XSIAM\", \"XQL\", \"XSIAM Copilot\", \"Automation Center\", \"Investigation Graph\", \"AI-driven SOC\", \"Palo Alto SIEM\", \"XDR to XSIAM\".

Expert agent for Cortex XSOAR. Provides deep expertise in playbook development (YAML/Python), war room collaboration, indicator management, TIM (Threat Intelligence Management), 900+ integrations, content marketplace, incident lifecycle, and Python scripting for custom automations. WHEN: \"XSOAR\", \"Cortex XSOAR\", \"XSOAR playbook\", \"war room\", \"XSOAR integration\", \"Demisto\", \"XSOAR script\", \"indicator management\", \"TIM\", \"XSOAR content pack\".

Expert agent for OWASP ZAP open-source DAST. Covers active/passive scanning, spidering (traditional+AJAX), authentication handling, API scanning (OpenAPI/GraphQL/SOAP), automation framework (YAML), add-ons, headless/Docker mode, and GitHub Actions integration. WHEN: \"OWASP ZAP\", \"ZAP\", \"zaproxy\", \"zap-cli\", \"ZAP automation framework\", \"zap-full-scan\", \"zap-api-scan\", \"zap-baseline-scan\", \"ZAP HUD\", \"zap docker\".

Expert agent for Zeek network analysis framework. Covers event-driven scripting, structured log analysis (conn.log, dns.log, http.log, ssl.log, files.log), protocol analysis, Intelligence Framework, cluster deployment, Spicy parsers, and Zeek packages. WHEN: \"Zeek\", \"Zeek script\", \"Zeek log\", \"conn.log\", \"zeekctl\", \"Bro\", \"network forensics\", \"Zeek Intelligence Framework\", \"Spicy parser\", \"Zeek cluster\".

Expert routing agent for Zero Trust and SASE. Covers NIST 800-207 zero trust architecture, SASE/SSE components (SWG, CASB, ZTNA, FWaaS), ZTNA vs VPN, identity-centric access, and SD-WAN convergence. WHEN: \"zero trust\", \"SASE\", \"SSE\", \"ZTNA\", \"SWG\", \"CASB\", \"FWaaS\", \"zero trust network access\", \"secure access service edge\", \"NIST 800-207\", \"replace VPN\", \"cloud firewall\". Do NOT use for platform-specific questions -- use the `zscaler`, `netskope`, `prisma-access`, `clou...

Expert agent for Zscaler Zero Trust Exchange. Covers ZIA internet access, ZPA private access, ZDX digital experience monitoring, App Connector deployment, and Zscaler's 150+ data center architecture. WHEN: \"Zscaler\", \"ZIA\", \"ZPA\", \"ZDX\", \"Zscaler Internet Access\", \"Zscaler Private Access\", \"Zscaler Digital Experience\", \"App Connector\", \"Zscaler tunnel\", \"ZCC client\", \"Zscaler policy\".

Amazon S3 cloud object storage service administration and design: storage classes, lifecycle policies, replication (CRR/SRR/RTC), versioning, Object Lock, encryption, access points, S3 Express One Zone, S3 Tables, Transfer Acceleration, and cost optimization. Use for \"S3\", \"AWS S3\", \"S3 bucket\", \"S3 lifecycle\", \"S3 Glacier\", \"S3 replication\", \"CRR\", \"SRR\", \"S3 Express\", \"S3 storage class\", \"S3 versioning\", \"Object Lock\", \"S3 Transfer Acceleration\", \"S3 access point\...

Azure Blob Storage service administration and design: storage accounts, access tiers (Hot/Cool/Cold/Archive), ADLS Gen2, lifecycle management, object replication, immutability (WORM), private endpoints, NFS 3.0, SFTP, and Microsoft Defender for Storage. Use for \"Azure Blob\", \"Blob Storage\", \"storage account\", \"access tier\", \"ADLS Gen2\", \"Data Lake Storage\", \"hierarchical namespace\", \"Azure archive\", \"blob lifecycle\", \"object replication\", \"immutability\", \"WORM Azure\", ...

Ceph distributed storage across all supported versions (Squid 19.2 through Tentacle 20.2): RADOS, CRUSH, BlueStore, RBD, CephFS, RGW, and cluster operations. Use for \"Ceph\", \"RADOS\", \"CRUSH map\", \"OSD\", \"BlueStore\", \"RBD\", \"CephFS\", \"RGW\", \"radosgw\", \"ceph health\", \"ceph status\", \"placement group\", \"PG\", \"erasure coding\", \"Ceph pool\", \"ceph-volume\", \"Cephadm\", \"Rook\", \"ceph osd\", \"ceph mon\", \"MDS\", \"Ceph dashboard\".

Dell PowerStore all-flash unified storage: PowerStoreOS, T-Series/X-Series hardware, AppsON, Metro Volume, inline data reduction, VMware vVols/VAAI integration, CSI driver, and migration from Unity/VNX. Use for \"PowerStore\", \"PowerStoreOS\", \"Dell PowerStore\", \"AppsON\", \"Metro Volume\", \"PowerStore T\", \"PowerStore X\", \"PowerStore migration\", \"PowerStore replication\", \"PowerStore CSI\".

Dell Unity XT midrange unified storage: dual-SP architecture, storage pools, FAST VP tiering, FAST Cache, NAS servers, UnityVSA, Unisphere management, replication, and migration planning to PowerStore. Use for \"Dell Unity\", \"Unity XT\", \"UnityVSA\", \"Unisphere\", \"FAST VP\", \"FAST Cache\", \"Unity pool\", \"Unity replication\", \"Unity migration\", \"UEMCLI\".

Google Cloud Storage service administration and design: storage classes (Rapid, Standard, Nearline, Coldline, Archive), Autoclass, Hierarchical Namespace, lifecycle management, signed URLs, IAM, Pub/Sub notifications, Storage Transfer Service, and cost optimization. Use for \"GCS\", \"Google Cloud Storage\", \"gcloud storage\", \"gsutil\", \"Autoclass\", \"Nearline\", \"Coldline\", \"Archive storage\", \"Rapid storage\", \"signed URL\", \"GCS lifecycle\", \"GCS bucket\", \"HNS bucket\", \"Sto...

GlusterFS distributed filesystem: volume types (distributed, replicated, dispersed, arbiter), bricks, translators, self-heal, geo-replication, and Kubernetes integration via Kadalu. Use for \"GlusterFS\", \"Gluster\", \"gluster volume\", \"gluster peer\", \"brick\", \"self-heal\", \"split-brain\", \"geo-replication\", \"glusterd\", \"glusterfsd\", \"dispersed volume\", \"arbiter\", \"DHT\", \"AFR\", \"Kadalu\", \"gluster heal\".

HPE Alletra enterprise storage portfolio spanning Alletra 5000/6000/9000 and Alletra Storage MP B10000/X10000: CASL architecture, DASE disaggregation, InfoSight AIOps, GreenLake consumption, Peer Persistence, StoreOnce backup integration, and HPE CSI driver for Kubernetes. Use for \"HPE Alletra\", \"Alletra 5000\", \"Alletra 6000\", \"Alletra 9000\", \"Alletra MP\", \"B10000\", \"X10000\", \"InfoSight\", \"HPE GreenLake storage\", \"Peer Persistence\", \"HPE CSI\", \"Nimble\", \"Primera\", \"...

MinIO high-performance S3-compatible object storage: erasure coding, mc client, KES encryption, site replication, ILM, IAM, Kubernetes Operator, and AIStor. Use for \"MinIO\", \"minio\", \"mc client\", \"mc admin\", \"MinIO erasure\", \"MinIO operator\", \"KES\", \"MinIO bucket\", \"MinIO replication\", \"MinIO healing\", \"S3-compatible\", \"AIStor\", \"MinIO console\". Do NOT use for AWS S3, Azure Blob, or GCS specifics — use the `aws-s3`, `azure-blob`, or `gcs` skill instead.

NetApp ONTAP unified storage across all supported versions (9.14-9.18): WAFL, aggregates, FlexVol/FlexGroup, SnapMirror, MetroCluster, FabricPool, Trident CSI, and ONTAP One licensing. Use for \"NetApp\", \"ONTAP\", \"FAS\", \"AFF\", \"ASA\", \"WAFL\", \"SnapMirror\", \"SnapVault\", \"FlexClone\", \"FlexGroup\", \"FabricPool\", \"Trident\", \"StorageGRID\", \"ONTAP aggregate\", \"ONTAP volume\", \"ONTAP snapshot\", \"MetroCluster\", \"ONTAP S3\", \"ONTAP One\", \"ARP/AI\".

Cross-platform storage expertise for architecture selection, capacity planning, data protection design, and technology comparison across enterprise arrays, software-defined storage, and cloud object storage. Use when the question is cross-platform or strategic: \"storage\", \"SAN\", \"NAS\", \"object storage\", \"block storage\", \"file storage\", \"which storage platform\", \"RAID\", \"erasure coding\", \"deduplication\", \"snapshots\", \"replication\", \"tiering\", \"storage comparison\". D...

Pure Storage FlashArray (Everpure): Purity OS, DirectFlash modules, ActiveCluster, ActiveDR, SafeMode, Pure1 AIOps, Evergreen subscriptions, Pure Fusion, CSI driver, Cloud Block Store, and Portworx integration. Use for \"Pure Storage\", \"FlashArray\", \"Everpure\", \"Purity\", \"DirectFlash\", \"ActiveCluster\", \"ActiveDR\", \"SafeMode\", \"Pure1\", \"Pure Fusion\", \"Evergreen\", \"FlashArray//X\", \"FlashArray//C\", \"FlashArray//E\", \"Cloud Block Store\", \"Portworx\".

Windows Storage Spaces Direct (S2D) hyper-converged storage: Software Storage Bus, SBL cache, storage pools, virtual disks, ReFS, CSV, fault domains, RDMA/SMB Direct, Hyper-V integration, nested resiliency, and Azure Local. Use for \"Storage Spaces Direct\", \"S2D\", \"Azure Stack HCI\", \"Azure Local\", \"ReFS\", \"CSV\", \"Cluster Shared Volume\", \"Software Storage Bus\", \"nested resiliency\", \"mirror-accelerated parity\", \"S2D cache\", \"Get-PhysicalDisk\", \"Get-VirtualDisk\", \"HCI W...

Citrix Hypervisor (XenServer) expertise across all versions (6.x through 8.x, XCP-ng): Xen Type-1 hypervisor, dom0/domU architecture, XAPI toolstack, xe CLI, Storage Repositories (NFS, iSCSI, FC, GFS2), Open vSwitch networking, XenMotion live migration, pool management, HA with fencing, VM lifecycle, snapshots, backup strategies, and XenCenter/web console administration. Use for \"XenServer\", \"Citrix Hypervisor\", \"Xen\", \"xe \", \"XenCenter\", \"XenMotion\", \"dom0\", \"XAPI\".

Cloud virtual machine management across AWS EC2, Azure VMs, and Google Compute Engine: instance lifecycle (create, start, stop, resize, terminate), CLI tooling (aws ec2, az vm, gcloud compute), storage (EBS, Managed Disks, Persistent Disks), networking (VPCs, security groups, NSGs, firewall rules), monitoring (CloudWatch, Azure Monitor, Cloud Logging), remote execution (SSM, Run Command, SSH/IAP), images (AMIs, custom images, image galleries), auto-scaling, and cross-platform operational mapp...

KVM/QEMU with libvirt expertise across Linux distributions (RHEL, Ubuntu, Debian, Fedora, openSUSE): kernel hypervisor, QEMU device emulation, libvirt (libvirtd/virtqemud), virsh, virt-install, qemu-img, virt-manager, storage pools, virtual networking (bridges, NAT, macvtap, OVS, SR-IOV), VirtIO, CPU pinning, NUMA/hugepages, live migration, snapshots, and guest image tools (guestfish, virt-customize). Use for \"KVM\", \"QEMU\", \"libvirt\", \"virsh\", \"virt-install\", \"qemu-img\", \"virt-ma...

Nutanix AHV hyperconverged infrastructure expertise across all AOS versions: AHV (KVM-based hypervisor), Controller VM (CVM) architecture, Distributed Storage Fabric (DSF), Prism Element/Central management, acli/ncli CLI operations, Flow microsegmentation, Protection Domains, NearSync, Metro Availability, Leap DR orchestration, NCC health checks, storage containers, erasure coding, and cluster lifecycle management. Use for \"Nutanix\", \"AHV\", \"Prism\", \"acli\", \"ncli\", \"CVM\", \"DSF\",...

Domain router and cross-technology expert for server virtualization and hypervisor platforms. Covers Type-1 and Type-2 hypervisors, hardware-assisted virtualization, live migration, HA/FT, VM storage, VM networking, technology selection, and V2V migration. Use for \"virtualization\", \"hypervisor\", \"virtual machine\", \"VM\", \"which hypervisor\", \"vSphere vs Proxmox\", \"virtualization comparison\", \"vMotion\", \"live migration\", \"Type-1 vs Type-2\", or when the platform is ambiguous o...

Proxmox VE expertise across supported versions (8.x, 9.x): QEMU/KVM virtual machines, LXC system containers, Corosync clustering, HA Manager, Ceph integrated storage, ZFS, LVM-thin, vzdump/PBS backup, SDN (VXLAN/EVPN), Linux bridge and OVS networking, Cloud-Init, OVMF/UEFI, VirtIO drivers, and REST API automation via pvesh. Use for \"Proxmox\", \"PVE\", \"Proxmox VE\", \"qm\", \"pct\", \"pvesh\", \"pvecm\", \"Ceph Proxmox\", \"vzdump\", \"PBS\", \"Proxmox Backup Server\", \"pveam\", \"Corosyn...

VMware vSphere expertise across supported versions (8.x, 9.x): ESXi hypervisor, vCenter Server, vMotion, vSphere HA, Fault Tolerance, DRS, vSAN (OSA and ESA), distributed networking (vDS, NSX), storage (VMFS, NFS, vVols), PowerCLI automation, esxcli administration, govc scripting, VADP-based backup, esxtop performance analysis, and VM lifecycle management. Use for \"vSphere\", \"ESXi\", \"vCenter\", \"VMware\", \"PowerCLI\", \"vMotion\", \"vSAN\", \"DRS\", \"VCSA\", \"VMFS\", \"esxcli\", \"es...