creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-26 06:10:57 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/performing-cloud-incident-containment-procedures/references/workflows.md
+116
View File
@@ -0,0 +1,116 @@
# Cloud Incident Containment Workflows
## Workflow 1: AWS Credential Compromise Response
```
START: Compromised AWS Credentials Detected
|
v
[Identify Scope]
|-- Which IAM user/role is compromised?
|-- What permissions does it have?
|-- Review CloudTrail for unauthorized actions
|
v
[Immediate Containment]
|-- Disable all access keys
|-- Attach deny-all inline policy
|-- Revoke active sessions (date condition)
|-- Update role trust policy if needed
|
v
[Evidence Preservation]
|-- Export CloudTrail logs to S3 with Object Lock
|-- Snapshot any accessed resources
|-- Document all API calls by compromised identity
|
v
[Impact Assessment]
|-- What resources were accessed?
|-- Was data exfiltrated?
|-- Were new resources created?
|-- Were other accounts compromised?
|
v
[Remediation]
|-- Rotate all credentials
|-- Remove unauthorized resources
|-- Update IAM policies
|-- Enable MFA enforcement
|
v
END: Containment Complete
```
## Workflow 2: Cloud VM Compromise Response
```
START: Compromised Cloud VM Detected
|
v
[Preserve Evidence First]
|-- Create disk snapshot immediately
|-- Capture instance metadata
|-- Export relevant logs
|
v
[Network Isolation]
|-- Apply quarantine security group/NSG
|-- Remove public IP addresses
|-- Block outbound traffic
|-- Maintain forensic access only
|
v
[Assess Blast Radius]
|-- Check lateral movement indicators
|-- Review IAM role attached to instance
|-- Check for data access to other services
|
v
[Forensic Analysis]
|-- Mount snapshot to forensic workstation
|-- Analyze disk for malware/tools
|-- Review instance logs
|
v
[Recovery]
|-- Rebuild from known-good image
|-- Apply security hardening
|-- Restore from clean backup
|
v
END: VM Contained and Rebuilt
```
## Workflow 3: Multi-Cloud Containment
```
START: Multi-Cloud Incident
|
v
[Identify Affected Cloud Platforms]
|-- AWS accounts affected?
|-- Azure subscriptions affected?
|-- GCP projects affected?
|
v
[Parallel Containment]
|-- AWS: SecurityHub + GuardDuty response
|-- Azure: Defender + Sentinel playbooks
|-- GCP: SCC + Chronicle response
|
v
[Cross-Cloud Credential Check]
|-- Shared credentials between platforms?
|-- Federated identity compromise?
|-- Third-party integrations affected?
|
v
[Unified Evidence Collection]
|-- Centralize logs from all platforms
|-- Normalize timestamps to UTC
|-- Build cross-cloud timeline
|
v
END: Multi-Cloud Containment Complete
```