---
name: cyber-security-operations
description: Use when performing cybersecurity operations - offensive or
  defensive - including threat detection and hunting, SOC operations, incident response,
  digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence,
  cloud/container/network/application/API security, identity-access and zero-trust,
  OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps,
  cryptography, AI security, compliance and governance, and red-team or
  penetration testing under signed rules of engagement; routes to one of 800+ technique
  playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.
---

# Cyber Security Operations

## Authorized Use
This skill covers dual-use offensive and defensive techniques. Offensive playbooks
(red-team, penetration testing, credential access, C2, social-engineering simulation)
are for engagements you own or have explicit written authorization to test. Before any
offensive technique, confirm scope, a signed rules-of-engagement, and authority
(tasks/engagement-intake.md), and document every action for the engagement record.
Defensive, detection, forensic, and compliance playbooks assume you operate on systems
you are responsible for.

## Core Rule
Route, do not improvise. This skill does not contain techniques inline - it dispatches to
one self-contained playbook under playbooks/. Every recommendation names the objective,
the strategy basis, the technique's ATT&CK/D3FEND/NIST mapping, and the verification
or detection path.

## First Pass
1. Restate the objective: what outcome, on which systems, by when.
2. Classify the task into one category:
   - `detection-hunting` - detection engineering, threat hunting, SIEM analytics.
   - `soc-incident-response` - SOC operations, triage, incident response, containment.
   - `dfir-forensics` - disk/memory/network forensics, evidence acquisition, custody.
   - `malware-analysis` - static/dynamic analysis, reverse engineering, deobfuscation.
   - `threat-intelligence` - CTI, TTP mapping, actor tracking, IOC work.
   - `cloud-container-security` - cloud posture, Kubernetes/container, cloud IR.
   - `network-wireless-security` - network defense, traffic analysis, wireless.
   - `application-api-security` - web/app/API testing and hardening, OWASP.
   - `identity-access-zerotrust` - IAM, AD/Entra, zero-trust, credential protection.
   - `ot-ics-security` - OT/ICS/SCADA, historian, industrial protocols.
   - `endpoint-mobile-security` - endpoint hardening, EDR, mobile.
   - `vuln-supplychain-devsecops` - vulnerability management, supply chain, CI/CD security.
   - `offensive-security` - red-team, penetration testing, C2, social-engineering simulation.
   - `crypto-ai-emerging` - cryptography, AI security, blockchain, deception.
   - `compliance-governance` - CMMC/NIST/ISO, risk, privacy, audit.
3. For any `offensive-security` task, confirm first
   (tasks/engagement-intake.md). No scope, no action.
4. Route to one playbook: open references/INDEX.md, then references/index/<category>.md,
   and match a single playbook by name, tags, or ATT&CK technique ID. Do not read every
   playbook - locate one.
5. Read playbooks/<category>/<name>/PLAYBOOK.md and its local references/, scripts/, and
   assets/. Follow it exactly.
6. Execute with the loop: observe -> orient -> decide -> act -> verify. Each finding
   updates the plan. If the objective needs another technique, return to step 2.
7. Close with the right artifact (templates/): a forensic evidence report for DFIR, an
   engagement record for offensive work, a detection or remediation note otherwise.

## Routing Index
references/INDEX.md lists the 15 categories and their per-category index files. Each
references/index/<category>.md is a table of that category's playbooks (name, ATT&CK,
tags, description). Both are generated by scripts/build_index.py - regenerate after adding
or moving playbooks; never hand-edit them.

## Tasks
- tasks/triage-and-route.md - the routing procedure, applied to every request.
- tasks/engagement-intake.md - authorization gate before any offensive playbook.
- tasks/evidence-handling.md - chain of custody, SHA-256 hashing, court-ready output.

## Scripts and Templates
- scripts/build_index.py - regenerate the routing index from playbook frontmatter.
- scripts/credentials-pattern/ - credential/secret detection patterns (shared).
- templates/rules-of-engagement.md - authorization/RoE template.
- templates/forensic-evidence-report.md - court-ready evidence report.

## Standards Alignment
Playbooks carry MITRE ATT&CK technique IDs, MITRE D3FEND countermeasures, and NIST CSF
functions in their frontmatter. Use these to pair an offensive technique with its
detection, and to map defensive work to a control framework.