Claude Skills by mukul975

Deploy and query Arkime (formerly Moloch) for full packet capture network traffic analysis. Uses the Arkime API

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score

Configure and deploy Palo Alto Networks next-generation firewalls with App-ID, User-ID, zone-based policies,

Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper

'Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443,

'Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve comprehensive asset

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL.

'Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn

'This skill covers implementing a structured patch management program for OT/ICS environments where traditional

Patch management is the systematic process of identifying, testing, deploying, and verifying software updates

PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements

Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace

'This skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes

Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration

'Implements privileged session monitoring and recording using Privileged Access Management (PAM) solutions, focusing

Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware,

'Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model to separate

'Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies,

'Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based

Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated

Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings,

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital

Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application

Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon

Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end

Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.

'This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories.

'This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment

'Implements security chaos engineering experiments that deliberately disable or degrade security controls to

'Create, validate, and share STIX 2.1 threat intelligence objects using the stix2 Python library. Covers indicators,

'Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards,

Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events,

Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting

'Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics

'Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency

'Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom)

Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger

Implement automated incident response playbooks in Cortex XSOAR to orchestrate security workflows across SOC

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information)

Implement software supply chain integrity verification for container builds using the in-toto framework to create

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates

Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using

Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis,

'Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets,

'Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for

'Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing