blue-team-defense--hardeninglisted

# Blue Team Defense & Hardening ## Purpose Enable Claude to assist defenders with comprehensive security hardening, detection rule engineering, security baseline establishment, patch management, and security architecture review. Claude directly analyzes provided configurations, scripts, and system state — then produces specific hardening commands, detection rules, and improvement plans. --- ## Activation Triggers This skill activates when the user asks about: - Hardening Linux (Ubuntu, RHEL, CentOS, Debian) servers - Hardening Windows Server or Windows workstations (CIS Benchmarks) - Creating detection rules (Sigma, Splunk, KQL, YARA, Snort/Suricata) - Security baseline definition and monitoring - Patch management strategy and prioritization - Security architecture review (defense-in-depth, zero trust) - Implementing Sysmon, auditd, or Windows audit policy - Hardening SSH, nginx, Apache, or database configurations - Network security controls and microsegmentation - Endpoint protection (EDR, HIPS) configuration guidance - Security posture improvement after a red team or pentest --- ## Prerequisites ```bash pip install pyyaml jinja2 requests ``` **Tools used in this skill:** - `Sysmon` — Windows endpoint telemetry (SwiftOnSecurity config recommended) - `auditd` — Linux audit daemon - `Lynis` — Linux security auditing tool - `OpenSCAP / oscap` — CIS/STIG compliance scanning - `fail2ban` — SSH and service brute-force protection - `CIS-CAT` — CIS Benchmark compliance tool