[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF874RPNHERGFXM1WWC9KQ":3,"skill-same:01M6AF874RPNHERGFXM1WWC9KQ":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AF874RPNHERGFXM1WWC9KQ","implementing-microsegmentation-with-guardicore",null,"Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS\u002FHIPAA compliance requires validated network segmentation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing microsegmentation with guardicore","microsegmentation","lateral-movement","east-west-traffic","akamai","guardicore","segmentation","t1059","t1078","zero-trust","visualize","least-privilege","data","network","ZeRO","create","pr","architecture","cybersecurity","containers","2026-11-10 10:12:30",false,"---\nname: implementing-microsegmentation-with-guardicore\ndescription: 'Implements microsegmentation with Akamai Guardicore Segmentation to map\n  application dependencies, visualize east-west traffic flows, and create granular,\n  least-privilege network policies across VMs, containers, bare metal, and cloud.\n  Use when blocking lateral movement in a data center or when PCI DSS\u002FHIPAA\n  compliance requires validated network segmentation.\n\n  '\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- microsegmentation\n- guardicore\n- akamai\n- zero-trust\n- east-west-traffic\n- network-segmentation\n- lateral-movement\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1021\n- T1550\n---\n\n# Implementing Microsegmentation with Guardicore\n\n## When to Use\n\n- When implementing east-west traffic controls to prevent lateral movement within data centers\n- When needing application-level visibility into network communication patterns before writing segmentation policies\n- When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)\n- When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation\n- When deploying zero trust at the network layer with process-level granularity\n\n**Do not use** for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs\u002Fsecurity groups suffice, or when network team lacks capacity for ongoing policy management.\n\n## Prerequisites\n\n- Akamai Guardicore Segmentation license (Enterprise or Premium)\n- Guardicore Management Server deployed (on-prem or SaaS)\n- Agent deployment access to target workloads (Linux, Windows, Kubernetes)\n- Network visibility: SPAN\u002FTAP ports or VPC flow logs for agentless collection\n- Application owner engagement for dependency validation\n\n## Workflow\n\n### Step 1: Deploy Guardicore Agents on Workloads\n\nInstall agents to collect process-level network communication data.\n\n```bash\n# Linux agent installation\ncurl -sSL https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Flinux \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -o gc-agent-installer.sh\nchmod +x gc-agent-installer.sh\nsudo .\u002Fgc-agent-installer.sh \\\n  --management-url=https:\u002F\u002Fmanagement.guardicore.com \\\n  --site-id=datacenter-east \\\n  --label=\"web-tier\"\n\n# Windows agent installation (PowerShell)\n# Invoke-WebRequest -Uri \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Fwindows\" `\n#   -Headers @{\"Authorization\"=\"Bearer $GC_API_TOKEN\"} `\n#   -OutFile gc-agent-installer.exe\n# Start-Process -FilePath .\\gc-agent-installer.exe `\n#   -ArgumentList \"--management-url=https:\u002F\u002Fmanagement.guardicore.com\",\"--site-id=datacenter-east\" `\n#   -Wait\n\n# Kubernetes DaemonSet deployment\ncat > gc-daemonset.yaml \u003C\u003C 'EOF'\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: guardicore-agent\n  namespace: guardicore\nspec:\n  selector:\n    matchLabels:\n      app: gc-agent\n  template:\n    metadata:\n      labels:\n        app: gc-agent\n    spec:\n      hostNetwork: true\n      hostPID: true\n      containers:\n      - name: gc-agent\n        image: guardicore\u002Fagent:latest\n        securityContext:\n          privileged: true\n        env:\n        - name: GC_MANAGEMENT_URL\n          value: \"https:\u002F\u002Fmanagement.guardicore.com\"\n        - name: GC_API_KEY\n          valueFrom:\n            secretKeyRef:\n              name: gc-credentials\n              key: api-key\n        volumeMounts:\n        - mountPath: \u002Fhost\n          name: host-root\n      volumes:\n      - name: host-root\n        hostPath:\n          path: \u002F\nEOF\nkubectl apply -f gc-daemonset.yaml\n\n# Verify agent enrollment\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents?status=active\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" | python3 -m json.tool\n```\n\n### Step 2: Map Application Dependencies with Reveal\n\nUse Guardicore Reveal to discover and visualize application communication patterns.\n\n```bash\n# Query discovered application flows via API\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fconnections\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": {\"from\": \"2026-02-17T00:00:00Z\", \"to\": \"2026-02-24T00:00:00Z\"},\n    \"filter\": {\n      \"source_label\": \"web-tier\",\n      \"destination_label\": \"app-tier\"\n    },\n    \"aggregation\": \"process\",\n    \"limit\": 1000\n  }' | python3 -m json.tool\n\n# Export application dependency map\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fmaps\u002Fexport\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"format\": \"json\",\n    \"labels\": [\"web-tier\", \"app-tier\", \"db-tier\"],\n    \"time_range\": \"7d\"\n  }' -o app-dependency-map.json\n\n# Typical discovery findings:\n# web-tier -> app-tier: TCP 8080, 8443 (expected)\n# app-tier -> db-tier: TCP 5432, 3306 (expected)\n# web-tier -> db-tier: TCP 5432 (UNEXPECTED - should be blocked)\n# app-tier -> internet: TCP 443 (verify if needed)\n```\n\n### Step 3: Create Segmentation Labels and Policies\n\nDefine labels and create ring-fence policies around applications.\n\n```bash\n# Create labels for application tiers\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Flabels\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI-CDE\",\n    \"description\": \"Cardholder Data Environment workloads\",\n    \"criteria\": {\"ip_ranges\": [\"10.10.0.0\u002F16\"]},\n    \"color\": \"#FF0000\"\n  }'\n\n# Create segmentation policy: Allow web-to-app communication\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Web-to-App Allowed\",\n    \"action\": \"ALLOW\",\n    \"priority\": 100,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"app-tier\"]},\n    \"services\": [\n      {\"protocol\": \"TCP\", \"port\": 8080},\n      {\"protocol\": \"TCP\", \"port\": 8443}\n    ],\n    \"log\": true,\n    \"enabled\": true,\n    \"section\": \"application-segmentation\"\n  }'\n\n# Create deny policy: Block web-to-database direct access\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Block Web-to-DB Direct\",\n    \"action\": \"DENY\",\n    \"priority\": 200,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"db-tier\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n\n# Create ring-fence policy for PCI CDE\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI CDE Ring Fence\",\n    \"action\": \"DENY\",\n    \"priority\": 50,\n    \"source\": {\"labels\": [\"!PCI-CDE\"]},\n    \"destination\": {\"labels\": [\"PCI-CDE\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n```\n\n### Step 4: Test Policies in Reveal Mode Before Enforcement\n\nSimulate policy enforcement without blocking traffic.\n\n```bash\n# Enable reveal mode (log-only) for new policies\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"REVEAL\"}'\n\n# Check what would be blocked in reveal mode\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fviolations\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": \"24h\",\n    \"policy_id\": \"POLICY_ID\",\n    \"limit\": 100\n  }' | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor v in data.get('violations', []):\n    print(f\\\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\\\")\n\"\n\n# After validation, switch to enforcement\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"ENFORCE\"}'\n```\n\n### Step 5: Monitor and Respond to Policy Violations\n\nSet up alerting and continuous monitoring for segmentation violations.\n\n```bash\n# Configure SIEM integration for policy violations\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fintegrations\u002Fsyslog\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Splunk SIEM\",\n    \"host\": \"splunk-syslog.company.com\",\n    \"port\": 514,\n    \"protocol\": \"TCP\",\n    \"format\": \"CEF\",\n    \"events\": [\"policy_violation\", \"agent_status\", \"deception_alert\"]\n  }'\n\n# Splunk query for microsegmentation violations\n# index=guardicore sourcetype=guardicore:policy\n# | where action=\"DENY\" AND enforcement_mode=\"ENFORCE\"\n# | stats count by src_ip, dst_ip, dst_port, policy_name\n# | sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsegmentation | Network security technique creating granular security zones around individual workloads or applications to control east-west traffic |\n| Reveal Mode | Guardicore's simulation mode that logs policy decisions without enforcing them, allowing validation before blocking |\n| Ring-Fence Policy | Isolation policy that restricts all traffic into or out of a defined group of assets (e.g., PCI CDE) |\n| Application Dependency Map | Visual representation of discovered network communication patterns between workloads showing processes, ports, and protocols |\n| East-West Traffic | Network traffic flowing laterally between workloads within a data center, as opposed to north-south traffic crossing the perimeter |\n| Process-Level Visibility | Guardicore's ability to identify which process on a workload initiated or received a network connection |\n\n## Tools & Systems\n\n- **Akamai Guardicore Segmentation**: Agent-based microsegmentation platform with application visualization and policy enforcement\n- **Guardicore Reveal**: Network visualization engine mapping application dependencies across hybrid environments\n- **Guardicore Centra**: Management console for policy creation, monitoring, and incident investigation\n- **Guardicore Agents**: Lightweight agents deployed on workloads collecting process-level network telemetry\n- **Guardicore Insight**: Analytics engine for compliance reporting and segmentation effectiveness measurement\n\n## Common Scenarios\n\n### Scenario: PCI DSS Microsegmentation for E-Commerce Platform\n\n**Context**: An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.\n\n**Approach**:\n1. Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers\n2. Run Reveal for 2 weeks to map all communication patterns into and out of the CDE\n3. Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)\n4. Create ring-fence policy blocking all non-CDE to CDE traffic by default\n5. Create explicit allow policies for validated CDE communication paths\n6. Test in Reveal mode for 1 week, validate no legitimate traffic blocked\n7. Switch to enforcement mode and monitor for violations\n8. Generate PCI DSS segmentation validation report showing enforced controls\n\n**Pitfalls**: Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.\n\n## Output Format\n\n```\nMicrosegmentation Deployment Report\n==================================================\nOrganization: E-Commerce Corp\nReport Date: 2026-02-23\n\nAGENT DEPLOYMENT:\n  Total workloads:            500\n  Agents installed:           487 (97.4%)\n  Agents active:              482 (98.9%)\n  Agentless (flow logs):       13\n\nPOLICY COVERAGE:\n  Total policies:              45\n  Allow rules:                 38\n  Deny rules:                   7\n  Reveal mode:                  3\n  Enforced:                    42\n\nTRAFFIC ANALYSIS (7 days):\n  Total flows observed:        2,456,789\n  Flows matching allow:        2,441,234 (99.4%)\n  Flows matching deny:            15,555 (0.6%)\n  Unclassified flows:                 0\n\nPCI CDE ISOLATION:\n  CDE workloads:               200\n  Ring-fence violations:         0 (last 30 days)\n  Authorized CDE entry points:  4\n  Lateral movement paths blocked: 95%\n```\n","# Implementing Microsegmentation with Guardicore\n\n## When to Use\n\n- When implementing east-west traffic controls to prevent lateral movement within data centers\n- When needing application-level visibility into network communication patterns before writing segmentation policies\n- When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)\n- When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation\n- When deploying zero trust at the network layer with process-level granularity\n\n**Do not use** for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs\u002Fsecurity groups suffice, or when network team lacks capacity for ongoing policy management.\n\n## Prerequisites\n\n- Akamai Guardicore Segmentation license (Enterprise or Premium)\n- Guardicore Management Server deployed (on-prem or SaaS)\n- Agent deployment access to target workloads (Linux, Windows, Kubernetes)\n- Network visibility: SPAN\u002FTAP ports or VPC flow logs for agentless collection\n- Application owner engagement for dependency validation\n\n## Workflow\n\n### Step 1: Deploy Guardicore Agents on Workloads\n\nInstall agents to collect process-level network communication data.\n\n```bash\n# Linux agent installation\ncurl -sSL https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Flinux \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -o gc-agent-installer.sh\nchmod +x gc-agent-installer.sh\nsudo .\u002Fgc-agent-installer.sh \\\n  --management-url=https:\u002F\u002Fmanagement.guardicore.com \\\n  --site-id=datacenter-east \\\n  --label=\"web-tier\"\n\n# Windows agent installation (PowerShell)\n# Invoke-WebRequest -Uri \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Fwindows\" `\n#   -Headers @{\"Authorization\"=\"Bearer $GC_API_TOKEN\"} `\n#   -OutFile gc-agent-installer.exe\n# Start-Process -FilePath .\\gc-agent-installer.exe `\n#   -ArgumentList \"--management-url=https:\u002F\u002Fmanagement.guardicore.com\",\"--site-id=datacenter-east\" `\n#   -Wait\n\n# Kubernetes DaemonSet deployment\ncat > gc-daemonset.yaml \u003C\u003C 'EOF'\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: guardicore-agent\n  namespace: guardicore\nspec:\n  selector:\n    matchLabels:\n      app: gc-agent\n  template:\n    metadata:\n      labels:\n        app: gc-agent\n    spec:\n      hostNetwork: true\n      hostPID: true\n      containers:\n      - name: gc-agent\n        image: guardicore\u002Fagent:latest\n        securityContext:\n          privileged: true\n        env:\n        - name: GC_MANAGEMENT_URL\n          value: \"https:\u002F\u002Fmanagement.guardicore.com\"\n        - name: GC_API_KEY\n          valueFrom:\n            secretKeyRef:\n              name: gc-credentials\n              key: api-key\n        volumeMounts:\n        - mountPath: \u002Fhost\n          name: host-root\n      volumes:\n      - name: host-root\n        hostPath:\n          path: \u002F\nEOF\nkubectl apply -f gc-daemonset.yaml\n\n# Verify agent enrollment\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents?status=active\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" | python3 -m json.tool\n```\n\n### Step 2: Map Application Dependencies with Reveal\n\nUse Guardicore Reveal to discover and visualize application communication patterns.\n\n```bash\n# Query discovered application flows via API\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fconnections\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": {\"from\": \"2026-02-17T00:00:00Z\", \"to\": \"2026-02-24T00:00:00Z\"},\n    \"filter\": {\n      \"source_label\": \"web-tier\",\n      \"destination_label\": \"app-tier\"\n    },\n    \"aggregation\": \"process\",\n    \"limit\": 1000\n  }' | python3 -m json.tool\n\n# Export application dependency map\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fmaps\u002Fexport\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"format\": \"json\",\n    \"labels\": [\"web-tier\", \"app-tier\", \"db-tier\"],\n    \"time_range\": \"7d\"\n  }' -o app-dependency-map.json\n\n# Typical discovery findings:\n# web-tier -> app-tier: TCP 8080, 8443 (expected)\n# app-tier -> db-tier: TCP 5432, 3306 (expected)\n# web-tier -> db-tier: TCP 5432 (UNEXPECTED - should be blocked)\n# app-tier -> internet: TCP 443 (verify if needed)\n```\n\n### Step 3: Create Segmentation Labels and Policies\n\nDefine labels and create ring-fence policies around applications.\n\n```bash\n# Create labels for application tiers\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Flabels\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI-CDE\",\n    \"description\": \"Cardholder Data Environment workloads\",\n    \"criteria\": {\"ip_ranges\": [\"10.10.0.0\u002F16\"]},\n    \"color\": \"#FF0000\"\n  }'\n\n# Create segmentation policy: Allow web-to-app communication\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Web-to-App Allowed\",\n    \"action\": \"ALLOW\",\n    \"priority\": 100,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"app-tier\"]},\n    \"services\": [\n      {\"protocol\": \"TCP\", \"port\": 8080},\n      {\"protocol\": \"TCP\", \"port\": 8443}\n    ],\n    \"log\": true,\n    \"enabled\": true,\n    \"section\": \"application-segmentation\"\n  }'\n\n# Create deny policy: Block web-to-database direct access\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Block Web-to-DB Direct\",\n    \"action\": \"DENY\",\n    \"priority\": 200,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"db-tier\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n\n# Create ring-fence policy for PCI CDE\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI CDE Ring Fence\",\n    \"action\": \"DENY\",\n    \"priority\": 50,\n    \"source\": {\"labels\": [\"!PCI-CDE\"]},\n    \"destination\": {\"labels\": [\"PCI-CDE\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n```\n\n### Step 4: Test Policies in Reveal Mode Before Enforcement\n\nSimulate policy enforcement without blocking traffic.\n\n```bash\n# Enable reveal mode (log-only) for new policies\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"REVEAL\"}'\n\n# Check what would be blocked in reveal mode\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fviolations\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": \"24h\",\n    \"policy_id\": \"POLICY_ID\",\n    \"limit\": 100\n  }' | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor v in data.get('violations', []):\n    print(f\\\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\\\")\n\"\n\n# After validation, switch to enforcement\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"ENFORCE\"}'\n```\n\n### Step 5: Monitor and Respond to Policy Violations\n\nSet up alerting and continuous monitoring for segmentation violations.\n\n```bash\n# Configure SIEM integration for policy violations\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fintegrations\u002Fsyslog\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Splunk SIEM\",\n    \"host\": \"splunk-syslog.company.com\",\n    \"port\": 514,\n    \"protocol\": \"TCP\",\n    \"format\": \"CEF\",\n    \"events\": [\"policy_violation\", \"agent_status\", \"deception_alert\"]\n  }'\n\n# Splunk query for microsegmentation violations\n# index=guardicore sourcetype=guardicore:policy\n# | where action=\"DENY\" AND enforcement_mode=\"ENFORCE\"\n# | stats count by src_ip, dst_ip, dst_port, policy_name\n# | sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsegmentation | Network security technique creating granular security zones around individual workloads or applications to control east-west traffic |\n| Reveal Mode | Guardicore's simulation mode that logs policy decisions without enforcing them, allowing validation before blocking |\n| Ring-Fence Policy | Isolation policy that restricts all traffic into or out of a defined group of assets (e.g., PCI CDE) |\n| Application Dependency Map | Visual representation of discovered network communication patterns between workloads showing processes, ports, and protocols |\n| East-West Traffic | Network traffic flowing laterally between workloads within a data center, as opposed to north-south traffic crossing the perimeter |\n| Process-Level Visibility | Guardicore's ability to identify which process on a workload initiated or received a network connection |\n\n## Tools & Systems\n\n- **Akamai Guardicore Segmentation**: Agent-based microsegmentation platform with application visualization and policy enforcement\n- **Guardicore Reveal**: Network visualization engine mapping application dependencies across hybrid environments\n- **Guardicore Centra**: Management console for policy creation, monitoring, and incident investigation\n- **Guardicore Agents**: Lightweight agents deployed on workloads collecting process-level network telemetry\n- **Guardicore Insight**: Analytics engine for compliance reporting and segmentation effectiveness measurement\n\n## Common Scenarios\n\n### Scenario: PCI DSS Microsegmentation for E-Commerce Platform\n\n**Context**: An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.\n\n**Approach**:\n1. Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers\n2. Run Reveal for 2 weeks to map all communication patterns into and out of the CDE\n3. Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)\n4. Create ring-fence policy blocking all non-CDE to CDE traffic by default\n5. Create explicit allow policies for validated CDE communication paths\n6. Test in Reveal mode for 1 week, validate no legitimate traffic blocked\n7. Switch to enforcement mode and monitor for violations\n8. Generate PCI DSS segmentation validation report showing enforced controls\n\n**Pitfalls**: Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.\n\n## Output Format\n\n```\nMicrosegmentation Deployment Report\n==================================================\nOrganization: E-Commerce Corp\nReport Date: 2026-02-23\n\nAGENT DEPLOYMENT:\n  Total workloads:            500\n  Agents installed:           487 (97.4%)\n  Agents active:              482 (98.9%)\n  Agentless (flow logs):       13\n\nPOLICY COVERAGE:\n  Total policies:              45\n  Allow rules:                 38\n  Deny rules:                   7\n  Reveal mode:                  3\n  Enforced:                    42\n\nTRAFFIC ANALYSIS (7 days):\n  Total flows observed:        2,456,789\n  Flows matching allow:        2,441,234 (99.4%)\n  Flows matching deny:            15,555 (0.6%)\n  Unclassified flows:                 0\n\nPCI CDE ISOLATION:\n  CDE workloads:               200\n  Ring-fence violations:         0 (last 30 days)\n  Authorized CDE entry points:  4\n  Lateral movement paths blocked: 95%\n```\n",{"name":5,"tags":49,"author":51,"domain":42,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"mitre_attack":60},[25,29,28,33,27,50,26],"network-segmentation","mahipal","1.0",[54,55,56,57],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS\u002FHIPAA compliance requires validated network segmentation.\n",[61,62,63,64,65],"T1078","T1190","T1059","T1021","T1550","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-microsegmentation-with-guardicore",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-microsegmentation-with-guardicore",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-microsegmentation-with-guardicore",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-microsegmentation-with-guardicore","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",1687,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",5908,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002Fscripts\u002Fagent.py",[108,134,157,184,209,236],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,120,42,121,122,40,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,120,145,42,40,146,38,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,42,172,173,146,174,175,176,177,178,179,32,180,181,182,183],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,42,195,196,197,198,199,200,201,36,202,203,204,205,148,206,207,208],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[215],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,42,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,244,42,245,246,247,248,249,250,251,252,32,253,180,254,255,256,257,258,259],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]