mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 17:30:19 +03:00

Files

T

Mahipal 2fb6a9faff Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

2026-08-02 09:32:13 -07:00

2.5 KiB

Raw Blame History

name, description, domain, subdomain, tags, version, author, license, nist_csf, mitre_attack

name

description

domain

subdomain

Detecting Shadow IT Cloud Usage

Overview

Shadow IT refers to unauthorized SaaS applications and cloud services used without IT approval. This skill analyzes proxy logs, DNS query logs, and firewall/netflow data to identify unauthorized cloud service usage, classify discovered domains against known SaaS categories, measure data transfer volumes, and flag high-risk services based on security posture and compliance requirements.

When to Use

When investigating security incidents that require detecting shadow it cloud usage
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with pandas, tldextract
Proxy logs (Squid, Zscaler, or Palo Alto format) or DNS query logs
SaaS application catalog/blocklist for classification
Network firewall logs with FQDN resolution (optional)

Steps

Parse proxy access logs and extract destination domains with traffic volumes
Parse DNS query logs to identify resolved cloud service domains
Aggregate traffic by domain using pandas — total bytes, request counts, unique users
Classify domains against known SaaS categories (storage, email, dev tools, AI)
Flag unauthorized services not on the approved application list
Calculate risk scores based on data volume, user count, and service category
Generate shadow IT discovery report with remediation recommendations

Expected Output

JSON report listing discovered cloud services with traffic volumes, user counts, risk scores, and approval status
Top unauthorized services ranked by data exfiltration risk

2.5 KiB Raw Blame History