Initial commit - 611 cybersecurity skills across all subdomains

skills/building-phishing-reporting-button-workflow/references/standards.md

@@ -0,0 +1,28 @@
+# Standards & References: Building Phishing Reporting Button Workflow
+
+## MITRE ATT&CK References
+- **T1566.001**: Phishing: Spearphishing Attachment
+- **T1566.002**: Phishing: Spearphishing Link
+- **T1204**: User Execution
+- **D3-RERE**: User Reporting (MITRE D3FEND)
+
+## Industry Standards
+- **NIST SP 800-61 Rev.2**: Computer Security Incident Handling Guide
+- **CIS Controls v8 Control 14**: Security Awareness and Skills Training
+- **ISO 27001 A.6.3**: Information Security Awareness, Education and Training
+
+## Reporting Platform Comparison
+| Platform | Type | Integration | Auto-Triage |
+|---|---|---|---|
+| Microsoft Report Button | Built-in | M365 native | Via Sentinel/API |
+| Cofense Reporter + Triage | Third-party | M365, Google | Yes (Cofense Triage) |
+| KnowBe4 PAB | Third-party | M365, Google | Yes (KMSAT) |
+| Proofpoint CLEAR | Third-party | M365, Google | Yes (built-in) |
+| Hoxhunt | Third-party | M365, Google | Yes (AI-powered) |
+
+## Key Metrics
+- **Report Rate**: Percentage of phishing simulations reported (target: >70%)
+- **Mean Time to Triage**: Time from report to classification (target: <10 min)
+- **False Positive Rate**: Legitimate emails reported as phishing
+- **Threat Catch Rate**: Real threats first detected by user reports
+- **Reporter Accuracy**: Percentage of reports that are actual threats

skills/building-phishing-reporting-button-workflow/references/workflows.md

@@ -0,0 +1,69 @@
+# Workflows: Building Phishing Reporting Button Workflow
+
+## Workflow 1: Automated Phishing Report Triage
+
+```
+User clicks "Report Phishing" button
+  |
+  v
+[Email forwarded to reporting mailbox]
+  +-- Original email preserved with full headers
+  +-- Reporter identity recorded
+  |
+  v
+[SOAR platform ingests report]
+  |
+  v
+[Automated IOC extraction]
+  +-- Extract sender address and domain
+  +-- Extract all URLs from body
+  +-- Extract attachment hashes (MD5, SHA256)
+  +-- Parse email headers for authentication results
+  |
+  v
+[Automated analysis (parallel)]
+  +-- URLs -> VirusTotal, URLScan.io, PhishTank
+  +-- Attachments -> Sandbox detonation
+  +-- Sender -> Threat intelligence lookup
+  +-- Headers -> SPF/DKIM/DMARC validation
+  |
+  v
+[Classification]
+  +-- CONFIRMED PHISHING: High-confidence malicious
+  +-- SUSPICIOUS: Moderate indicators, needs analyst review
+  +-- SPAM: Unwanted but not malicious
+  +-- SIMULATION: Matches internal phishing test
+  +-- CLEAN: Legitimate email, false report
+  |
+  v
+[Automated response by classification]
+  +-- PHISHING: Retract from all inboxes + block sender
+  +-- SUSPICIOUS: Escalate to SOC analyst
+  +-- SPAM: Move to junk for all recipients
+  +-- SIMULATION: Credit reporter in training platform
+  +-- CLEAN: Return to inbox
+  |
+  v
+[Feedback to reporter]
+  +-- "Thank you for reporting" (immediate)
+  +-- Classification result (when complete)
+  +-- Training tip (if false positive)
+```
+
+## Workflow 2: SOC Analyst Escalation
+
+```
+SOAR classifies report as SUSPICIOUS
+  |
+  v
+[SOC analyst reviews]
+  +-- Examine full email content and headers
+  +-- Verify automated analysis results
+  +-- Check for similar reports from other users
+  |
+  v
+[Analyst decision]
+  +-- Confirm malicious --> Trigger remediation playbook
+  +-- Confirm clean --> Close and notify reporter
+  +-- Need more info --> Contact reporter for context
+```