creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-20 06:20:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md
+59
View File
@@ -0,0 +1,59 @@
# Standards and References - EPSS Vulnerability Prioritization
## Primary Standards
### FIRST EPSS
- **Source**: Forum of Incident Response and Security Teams
- **URL**: https://www.first.org/epss/
- **API**: https://api.first.org/data/v1/epss
- **Model**: Machine learning trained on real exploitation events, updated daily
- **Versions**: v1 (2021), v2 (2022), v3 (2023), v4 (2025)
### CVSS v3.1 and v4.0
- **Source**: FIRST
- **URL**: https://www.first.org/cvss/
- **Relevance**: EPSS complements CVSS; CVSS measures severity, EPSS measures exploitation probability
### CISA Stakeholder-Specific Vulnerability Categorization (SSVC)
- **URL**: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- **Relevance**: SSVC uses exploitation status as a key decision point; EPSS provides data-driven input
### CISA Known Exploited Vulnerabilities (KEV)
- **URL**: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- **Relevance**: KEV confirms active exploitation; EPSS predicts future exploitation probability
## Research Papers
### Original EPSS Paper
- **Title**: "Improving Vulnerability Remediation Through Better Exploit Prediction"
- **Authors**: Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid
- **Published**: Workshop on the Economics of Information Security (WEIS), 2021
### EPSS v3 Model
- **Features**: 1,477 features including CVE properties, vendor data, social media mentions, exploit code availability
- **Training Data**: Historical exploitation events from multiple sources
- **Performance**: AUC of 0.85+ for 30-day exploitation prediction
## Data Sources Used by EPSS
| Source | Data Type | Update Frequency |
|--------|----------|-----------------|
| NVD | CVE metadata, CVSS scores | Real-time |
| CISA KEV | Confirmed exploitation | As new CVEs added |
| Exploit-DB | Public exploit code | Daily |
| GitHub | Exploit PoC repositories | Daily |
| Metasploit | Exploit modules | Weekly |
| SecurityFocus | Vulnerability discussions | Daily |
| Social Media | Twitter/X mentions of CVEs | Real-time |
| Fortinet | Exploitation telemetry | Daily |
| AlienVault OTX | Threat intelligence | Daily |
## API Reference
### Endpoints
- **Single CVE**: `GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN`
- **Multiple CVEs**: `GET https://api.first.org/data/v1/epss?cve=CVE-1,CVE-2,...`
- **Date-specific**: `GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN&date=YYYY-MM-DD`
- **Time series**: `GET https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNNN&scope=time-series`
- **Top scoring**: `GET https://api.first.org/data/v1/epss?percentile-gt=0.95`
- **Full download**: `https://epss.cyentia.com/epss_scores-current.csv.gz`
skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md
+32
View File
@@ -0,0 +1,32 @@
# Workflows - EPSS Vulnerability Prioritization
## Workflow 1: Daily EPSS Enrichment Pipeline
### Steps
1. Download full EPSS dataset from https://epss.cyentia.com/epss_scores-current.csv.gz
2. Load into local database for fast lookups
3. Query open vulnerabilities from vulnerability management platform
4. Enrich each CVE with current EPSS score and percentile
5. Apply priority matrix combining EPSS and CVSS scores
6. Update priority fields in DefectDojo/Jira/tracking system
7. Alert on any CVEs that crossed EPSS threshold (e.g., jumped above 0.4)
## Workflow 2: EPSS Spike Detection
### Steps
1. Compare today's EPSS scores against yesterday's scores for all open CVEs
2. Identify CVEs with EPSS increase > 0.2 in past 24 hours
3. Cross-reference spike CVEs with asset inventory
4. Send high-priority alert for spiking CVEs affecting production assets
5. Automatically escalate to P1 if EPSS crosses 0.7 threshold
## Workflow 3: Prioritized Remediation Report
### Steps
1. Pull all open vulnerabilities from scanner
2. Enrich with EPSS scores and CISA KEV membership
3. Apply combined EPSS + CVSS + KEV priority matrix
4. Group by priority tier (P0-P4)
5. Within each tier, sort by EPSS score descending
6. Generate report showing estimated risk reduction per remediation action
7. Distribute to asset owners with assigned remediation timelines