security-tooling-skills

Plugin security-tooling-skills from marketplace ops-engineering-skills in selvarajmurugesan90/ops-engineering-skills. Commands read from the repo's manifest — 1 month ago.

Skills (15)

• certificate-lifecycle-management-at-scale

  Guides managing TLS/mTLS certificate lifecycle across many services and environments beyond a single Kubernetes cluster — enterprise CA integration (ACME private CA, Microsoft AD CS, cloud-managed private CAs), cross-service rotation automation, expiry monitoring/alerting, and CA hierarchy/trust-cha

• enterprise-sso-and-idp-federation-configuration

  Guides configuring enterprise workforce single sign-on — SAML 2.0 and OIDC federation between an identity provider (Okta, Azure AD/Entra ID, Keycloak) and downstream applications, including metadata exchange, attribute/claim mapping, group-to-role provisioning (SCIM), and multi-IdP federation trust.

• falco-configuration-validation

  Validates Falco runtime detection rules for false-positive rate and actual firing correctness before trusting them in a channel that pages a human — running new/changed rules in log-only mode against real traffic, measuring alert volume and content, and confirming a rule fires on a deliberate positi

• falco-runtime-threat-detection-configuration

  Guides authoring and deploying Falco runtime threat detection rules — the eBPF/kernel-module-based syscall event stream, Falco's rule syntax (condition/output/priority), writing custom rules for a specific workload's known-good behavior, tuning noisy default rules, and wiring alerts to Falcosidekick

• fortify-static-analysis

  Guides deep, tool-specific use of OpenText (formerly Micro Focus) Fortify Static Code Analyzer (SCA) and Fortify Audit Workbench for enterprise, on-premises static analysis — the translate/scan build workflow, Fortify Security Rulepacks, audit workbench triage (Not an Issue / Reliability / Suspiciou

• kubewarden-admission-policy-configuration

  Guides configuring Kubewarden as a WASM-based Kubernetes admission policy engine — installing the policy-server and controller, writing or reusing WebAssembly policies from the Kubewarden Policy Hub, ClusterAdmissionPolicy/AdmissionPolicy resources, monitor-mode rollout before enforce, and multi-lan

• owasp-zap-dast-configuration

  Guides deep, tool-specific configuration of OWASP ZAP (Zed Attack Proxy) for automated dynamic scanning — baseline vs. full active scan selection, the ZAP Automation Framework YAML plan, authenticated scanning via authentication scripts/contexts, and API-driven scans seeded from an OpenAPI spec. Use

• prisma-cloud-cspm-and-workload-protection

  Guides deep, tool-specific use of Palo Alto Networks Prisma Cloud for Cloud Security Posture Management (CSPM) across AWS/Azure/GCP accounts, IaC scanning (Terraform/CloudFormation) via Prisma's checkov-based engine, and agent-based workload protection (Defender agents) for hosts, containers, and se

• sealed-secrets-and-external-secrets-operator

  Guides deep, Kubernetes-native implementation of two GitOps-friendly secrets patterns — Bitnami Sealed Secrets (controller install, kubeseal CLI encryption workflow, the SealedSecret CRD) and External Secrets Operator (SecretStore/ClusterSecretStore/ExternalSecret CRDs syncing from Vault, AWS Secret

• sonarqube-code-quality-and-security

  Guides deep, tool-specific configuration of SonarQube/SonarCloud for combined code quality and security analysis — quality gate design, pull request decoration, technical debt ratio and maintainability rating, security hotspot triage, and sonar-project.properties/scanner CI wiring. Use when the user

• spiffe-spire-workload-identity-configuration

  Guides configuring SPIRE Server and Agent to issue cryptographic workload identities (SPIFFE IDs, X.509-SVIDs, JWT-SVIDs) for zero-trust service-to-service authentication — trust domain design, node and workload attestation (registration entries with selectors), SVID rotation, and federation between

• sysdig-secure-runtime-security

  Guides deep, tool-specific use of Sysdig Secure for runtime threat detection built on Falco rules under the hood, container/host image scanning, compliance checks (CIS Benchmarks), and the incident response workflow from a runtime alert through forensic capture. Use when the user asks to "write a Fa

• trivy-vulnerability-scanning

  Guides deep, tool-specific use of Aqua Trivy to scan container images, filesystems, git repositories, and Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles) for known vulnerabilities, misconfigurations, exposed secrets, and license issues. Use when the user asks to

• vault-configuration-validation

  Guides validating HashiCorp Vault policies (HCL/Rego-less ACL policies), auth method configuration, and seal/storage configuration before rollout — catching an overly broad policy, a misconfigured auth-method role binding, or an unsafe seal migration before it reaches a production cluster. Use when

• vault-operations-and-pki-engine-configuration

  Guides operating a HashiCorp Vault cluster itself — initialization, unsealing (Shamir key shares or auto-unseal via cloud KMS/HSM), configuring the PKI secrets engine for internal certificate issuance (root/intermediate CA hierarchy, roles, short-lived leaf certs), and HA/DR cluster topology (Raft i

Similar plugins