Agent skill
implementing-zero-trust-endpoint-compliance
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/implementing-zero-trust-endpoint-compliance
SKILL.md
name: implementing-zero-trust-endpoint-compliance description: >- Implement continuous endpoint compliance verification as a condition for zero trust network and resource access. domain: cybersecurity subdomain: zero-trust tags:
- endpoint-compliance
- continuous-verification
- device-health
- compliance-checks
- posture-assessment version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1078"] cwe: ["CWE-693"] tools: ["intune", "jamf", "crowdstrike-falcon"]
Implementing Zero Trust Endpoint Compliance
Overview
Implement continuous endpoint compliance verification as a condition for zero trust network and resource access.
Prerequisites
| Tool / Requirement | Details |
|---|---|
intune |
Security tooling |
jamf |
Security tooling |
crowdstrike-falcon |
Security tooling |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |
| Relevant target samples or systems acquired through authorized channels | Environment requirement |
Quick Reference
# Initialize working environment
mkdir -p /tmp/implementing-zero-trust-endpoint-compliance/{output,logs,artifacts}
# Execute primary analysis with intune
echo "[*] Running Implementing Zero Trust Endpoint Compliance with intune..."
# Validate results with jamf
echo "[*] Cross-validating with jamf..."
# Generate summary report
cat /tmp/implementing-zero-trust-endpoint-compliance/output/report.json
Workflow
Step 1: Preparation and Reconnaissance
# Identify target and gather initial intelligence
file ./target_sample
intune --version 2>/dev/null || echo "Install intune"
# Set up working directory
mkdir -p /tmp/implementing-zero-trust-endpoint-compliance/{output,logs,artifacts}
Step 2: Primary Analysis
# Execute primary analysis with intune
# Refer to Quick Reference above for detailed commands
echo "[*] Running Implementing Zero Trust Endpoint Compliance with intune..."
# Log all operations
script -q /tmp/implementing-zero-trust-endpoint-compliance/logs/session.log
Step 3: Deep Investigation
# Apply jamf for secondary analysis
echo "[*] Deep investigation with jamf..."
# Cross-reference findings
diff /tmp/implementing-zero-trust-endpoint-compliance/output/primary.json /tmp/implementing-zero-trust-endpoint-compliance/output/secondary.json
Step 4: Documentation and Reporting
# Generate structured findings report
cat <<'EOF' > /tmp/implementing-zero-trust-endpoint-compliance/output/report.json
{
"technique": "implementing-zero-trust-endpoint-compliance",
"domain": "zero-trust",
"tools_used": ["intune", "jamf"],
"findings": [],
"recommendations": []
}
EOF
Detection
title: Zero Trust Endpoint Compliance Detection
id: fd934d37-f81a-4323-bfc1-9c5e4b94594a
status: experimental
description: Detects suspicious activity related to implementing zero trust endpoint compliance techniques in zero trust context
logsource:
category: authentication
product: windows
detection:
selection:
EventType: authentication
Status: failure
condition: selection
level: medium
tags:
- attack.t1078
- attack.lateral_movement
falsepositives:
- Zero trust policy engine evaluating routine access requests
Detection Opportunities
| Indicator | Source | Detection Logic |
|---|---|---|
| Zero Trust Endpoint Compliance Detection | windows/authentication | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078 |
Verification
- Environment and tools verified and operational
- Target samples acquired through authorized channels
- Primary analysis completed with findings documented
- Secondary validation performed with independent tooling
- All artifacts preserved in structured output directory
- Detection opportunities documented for blue team
References
- MITRE ATT&CK T1078 — Related technique
- intune Documentation — Primary tooling
- jamf Reference — Secondary tooling
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?