[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFYWCRB8MXBBYMP5ZD0PSN":3,"skill-same:01M6AFYWCRB8MXBBYMP5ZD0PSN":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":79,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M6AFYWCRB8MXBBYMP5ZD0PSN","performing-ot-vulnerability-assessment-with-claroty",null,"Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE\u002FICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ot-vulnerability-assessment-with-claroty\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"performing ot vulnerability assessment with claroty","vulnerability","claroty","assessment","remediation","xdome","ICS-security","risk","t1059","t1078","ot-security","testing","penetration testing","cve","deployment","pr","risk scoring","cybersecurity","security","safe","2026-11-10 10:12:30",false,"---\nname: performing-ot-vulnerability-assessment-with-claroty\ndescription: Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE\u002FICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- vulnerability-assessment\n- claroty\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Performing OT Vulnerability Assessment with Claroty\n\n## When to Use\n\n- When conducting scheduled OT vulnerability assessments per IEC 62443 or NERC CIP requirements\n- When deploying Claroty xDome for the first time and performing initial asset discovery and risk assessment\n- When correlating newly published ICS-CERT advisories against your OT asset inventory\n- When prioritizing OT vulnerability remediation with limited maintenance windows\n- When generating compliance evidence for CIP-010-4 vulnerability assessment requirements\n\n**Do not use** for active vulnerability scanning of PLCs and safety systems (see performing-ot-network-security-assessment for passive approaches), for IT-only vulnerability management (see standard vulnerability scanners), or for penetration testing (see performing-ics-penetration-testing).\n\n## Prerequisites\n\n- Claroty xDome or CTD (Continuous Threat Detection) deployed with sensors on OT network\n- Network SPAN\u002FTAP access for passive asset discovery\n- CISA ICS-CERT advisory subscription for vulnerability tracking\n- Asset inventory with firmware versions for all OT devices\n- Change management process for patch deployment during maintenance windows\n\n## Workflow\n\n### Step 1: Configure Asset Discovery and Vulnerability Correlation\n\nConfigure Claroty to perform passive and active-safe discovery to build complete asset inventory with firmware versions for vulnerability correlation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Vulnerability Assessment Manager.\n\nCorrelates OT asset inventory with ICS-CERT advisories and CVE data\nto identify, prioritize, and track OT vulnerabilities. Designed to\nintegrate with Claroty xDome API or standalone operation.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\nimport requests\n\n\n@dataclass\nclass OTAsset:\n    asset_id: str\n    name: str\n    vendor: str\n    model: str\n    firmware_version: str\n    asset_type: str  # PLC, HMI, RTU, historian, switch, etc.\n    purdue_level: str\n    ip_address: str\n    protocol: str\n    criticality: str  # critical, high, medium, low\n    zone: str\n\n\n@dataclass\nclass OTVulnerability:\n    vuln_id: str\n    cve_id: str\n    title: str\n    severity: str  # critical, high, medium, low\n    cvss_score: float\n    affected_vendor: str\n    affected_product: str\n    affected_versions: str\n    description: str\n    ics_cert_advisory: str = \"\"\n    remediation: str = \"\"\n    patch_available: bool = False\n    compensating_controls: str = \"\"\n\n\n@dataclass\nclass RiskAssessment:\n    asset: OTAsset\n    vulnerability: OTVulnerability\n    risk_score: float = 0.0\n    risk_rating: str = \"\"\n    exploitability: str = \"\"\n    operational_impact: str = \"\"\n    compensating_controls: list = field(default_factory=list)\n    remediation_priority: int = 0\n\n\nclass OTVulnerabilityAssessment:\n    \"\"\"OT vulnerability assessment and prioritization engine.\"\"\"\n\n    def __init__(self):\n        self.assets = []\n        self.vulnerabilities = []\n        self.risk_assessments = []\n\n    def load_assets(self, assets_data):\n        \"\"\"Load asset inventory from Claroty export or manual inventory.\"\"\"\n        for a in assets_data:\n            self.assets.append(OTAsset(**a))\n        print(f\"[*] Loaded {len(self.assets)} OT assets\")\n\n    def fetch_ics_advisories(self):\n        \"\"\"Fetch latest ICS-CERT advisories from CISA.\"\"\"\n        print(\"[*] Fetching ICS-CERT advisories from CISA...\")\n        try:\n            # CISA Known Exploited Vulnerabilities catalog\n            url = \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n            resp = requests.get(url, timeout=30)\n            resp.raise_for_status()\n            data = resp.json()\n\n            ics_vulns = []\n            for vuln in data.get(\"vulnerabilities\", []):\n                # Filter for ICS-relevant vendors\n                ics_vendors = [\n                    \"siemens\", \"schneider\", \"rockwell\", \"honeywell\",\n                    \"abb\", \"ge\", \"emerson\", \"yokogawa\", \"omron\",\n                    \"mitsubishi\", \"phoenix\", \"moxa\", \"advantech\",\n                ]\n                vendor = vuln.get(\"vendorProject\", \"\").lower()\n                if any(v in vendor for v in ics_vendors):\n                    ics_vulns.append(vuln)\n\n            print(f\"  Found {len(ics_vulns)} ICS-relevant known exploited vulnerabilities\")\n            return ics_vulns\n\n        except Exception as e:\n            print(f\"[WARN] Could not fetch advisories: {e}\")\n            return []\n\n    def correlate_vulnerabilities(self):\n        \"\"\"Match vulnerabilities to assets based on vendor\u002Fmodel\u002Ffirmware.\"\"\"\n        print(\"[*] Correlating vulnerabilities to assets...\")\n\n        for asset in self.assets:\n            for vuln in self.vulnerabilities:\n                if (vuln.affected_vendor.lower() in asset.vendor.lower() and\n                    vuln.affected_product.lower() in asset.model.lower()):\n                    # Check firmware version if specified\n                    ra = RiskAssessment(asset=asset, vulnerability=vuln)\n                    self._calculate_risk_score(ra)\n                    self.risk_assessments.append(ra)\n\n        print(f\"  Correlated {len(self.risk_assessments)} asset-vulnerability pairs\")\n\n    def _calculate_risk_score(self, ra):\n        \"\"\"Calculate OT-specific risk score considering operational impact.\"\"\"\n        # Base score from CVSS\n        base = ra.vulnerability.cvss_score\n\n        # Criticality multiplier based on asset function\n        criticality_weights = {\n            \"critical\": 1.5,  # SIS, safety systems\n            \"high\": 1.3,      # PLCs, primary control\n            \"medium\": 1.0,    # HMIs, historians\n            \"low\": 0.7,       # non-critical support systems\n        }\n        criticality = criticality_weights.get(ra.asset.criticality, 1.0)\n\n        # Purdue level proximity factor (lower levels = higher risk)\n        level_weights = {\n            \"Level 0-1\": 1.5,\n            \"Level 2\": 1.3,\n            \"Level 3\": 1.0,\n            \"Level 3.5\": 0.8,\n            \"Level 4\": 0.6,\n        }\n        level_factor = level_weights.get(ra.asset.purdue_level, 1.0)\n\n        # Network exposure reduction if compensating controls exist\n        comp_reduction = 0.8 if ra.compensating_controls else 1.0\n\n        ra.risk_score = round(base * criticality * level_factor * comp_reduction, 1)\n        ra.risk_score = min(ra.risk_score, 10.0)\n\n        if ra.risk_score >= 9.0:\n            ra.risk_rating = \"critical\"\n            ra.remediation_priority = 1\n        elif ra.risk_score >= 7.0:\n            ra.risk_rating = \"high\"\n            ra.remediation_priority = 2\n        elif ra.risk_score >= 4.0:\n            ra.risk_rating = \"medium\"\n            ra.remediation_priority = 3\n        else:\n            ra.risk_rating = \"low\"\n            ra.remediation_priority = 4\n\n    def generate_report(self):\n        \"\"\"Generate vulnerability assessment report.\"\"\"\n        # Sort by risk score descending\n        sorted_ra = sorted(self.risk_assessments, key=lambda x: -x.risk_score)\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT VULNERABILITY ASSESSMENT REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(f\"Assets: {len(self.assets)} | Vulnerabilities: {len(self.vulnerabilities)}\")\n        report.append(f\"Risk Assessments: {len(self.risk_assessments)}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [ra for ra in sorted_ra if ra.risk_rating == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} RISK ({len(findings)}) ---\")\n                for ra in findings[:10]:\n                    report.append(f\"\\n  Risk Score: {ra.risk_score}\u002F10.0\")\n                    report.append(f\"  Asset: {ra.asset.name} ({ra.asset.vendor} {ra.asset.model})\")\n                    report.append(f\"  Zone: {ra.asset.zone} ({ra.asset.purdue_level})\")\n                    report.append(f\"  CVE: {ra.vulnerability.cve_id} (CVSS: {ra.vulnerability.cvss_score})\")\n                    report.append(f\"  Title: {ra.vulnerability.title}\")\n                    if ra.vulnerability.patch_available:\n                        report.append(f\"  Patch: Available - schedule for next maintenance window\")\n                    else:\n                        report.append(f\"  Patch: Not available - apply compensating controls\")\n\n        return \"\\n\".join(report)\n\n    def export_json(self, output_file):\n        \"\"\"Export assessment to JSON.\"\"\"\n        data = {\n            \"assessment_date\": datetime.now().isoformat(),\n            \"asset_count\": len(self.assets),\n            \"vulnerability_count\": len(self.vulnerabilities),\n            \"risk_assessments\": [\n                {\n                    \"asset_name\": ra.asset.name,\n                    \"asset_ip\": ra.asset.ip_address,\n                    \"cve\": ra.vulnerability.cve_id,\n                    \"risk_score\": ra.risk_score,\n                    \"risk_rating\": ra.risk_rating,\n                    \"priority\": ra.remediation_priority,\n                }\n                for ra in sorted(self.risk_assessments, key=lambda x: -x.risk_score)\n            ],\n        }\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n\n\nif __name__ == \"__main__\":\n    assessment = OTVulnerabilityAssessment()\n    advisories = assessment.fetch_ics_advisories()\n    print(f\"Fetched {len(advisories)} ICS advisories from CISA KEV catalog\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Claroty xDome | Cyber-physical systems protection platform providing asset discovery, vulnerability management, and threat detection for OT\u002FIoT environments |\n| Passive Discovery | Identifying OT assets by analyzing network traffic without sending any packets, safe for production environments |\n| Safe Active Query | Querying OT devices using native industrial protocols at safe rates to collect detailed asset information without disrupting operations |\n| OT Risk Score | Risk rating that factors CVSS base score, asset criticality, Purdue level, and compensating controls for OT-appropriate prioritization |\n| ICS-CERT Advisory | CISA-published security advisories for industrial control system vulnerabilities with vendor-specific remediation guidance |\n| Virtual Patching | Deploying IPS\u002Ffirewall rules to block exploitation of known vulnerabilities when firmware patches cannot be immediately applied |\n\n## Tools & Systems\n\n- **Claroty xDome**: Comprehensive OT\u002FIoT asset discovery, vulnerability management, and continuous threat detection platform\n- **Claroty CTD**: Continuous Threat Detection sensor for passive network monitoring in OT environments\n- **CISA ICS-CERT**: US government advisory service publishing ICS vulnerability notifications and mitigation guidance\n- **Dragos Platform**: Alternative OT security platform with asset visibility and vulnerability management capabilities\n- **Nozomi Networks Guardian**: OT monitoring platform with vulnerability correlation and risk scoring\n\n## Output Format\n\n```\nOT Vulnerability Assessment Report\n=====================================\nTool: Claroty xDome \u002F Manual Assessment\nDate: YYYY-MM-DD\nAssets Scanned: [N]\n\nRISK SUMMARY:\n  Critical Risk: [N] vulnerabilities on [N] assets\n  High Risk: [N] vulnerabilities on [N] assets\n  Medium Risk: [N] vulnerabilities on [N] assets\n  Low Risk: [N] vulnerabilities on [N] assets\n\nTOP RISKS:\n  [Risk Score] [CVE-ID] on [Asset Name] ([Zone])\n    Remediation: [Patch\u002FCompensating Control]\n    Timeline: [Next maintenance window \u002F Immediate]\n```\n","# Performing OT Vulnerability Assessment with Claroty\n\n## When to Use\n\n- When conducting scheduled OT vulnerability assessments per IEC 62443 or NERC CIP requirements\n- When deploying Claroty xDome for the first time and performing initial asset discovery and risk assessment\n- When correlating newly published ICS-CERT advisories against your OT asset inventory\n- When prioritizing OT vulnerability remediation with limited maintenance windows\n- When generating compliance evidence for CIP-010-4 vulnerability assessment requirements\n\n**Do not use** for active vulnerability scanning of PLCs and safety systems (see performing-ot-network-security-assessment for passive approaches), for IT-only vulnerability management (see standard vulnerability scanners), or for penetration testing (see performing-ics-penetration-testing).\n\n## Prerequisites\n\n- Claroty xDome or CTD (Continuous Threat Detection) deployed with sensors on OT network\n- Network SPAN\u002FTAP access for passive asset discovery\n- CISA ICS-CERT advisory subscription for vulnerability tracking\n- Asset inventory with firmware versions for all OT devices\n- Change management process for patch deployment during maintenance windows\n\n## Workflow\n\n### Step 1: Configure Asset Discovery and Vulnerability Correlation\n\nConfigure Claroty to perform passive and active-safe discovery to build complete asset inventory with firmware versions for vulnerability correlation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Vulnerability Assessment Manager.\n\nCorrelates OT asset inventory with ICS-CERT advisories and CVE data\nto identify, prioritize, and track OT vulnerabilities. Designed to\nintegrate with Claroty xDome API or standalone operation.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\nimport requests\n\n\n@dataclass\nclass OTAsset:\n    asset_id: str\n    name: str\n    vendor: str\n    model: str\n    firmware_version: str\n    asset_type: str  # PLC, HMI, RTU, historian, switch, etc.\n    purdue_level: str\n    ip_address: str\n    protocol: str\n    criticality: str  # critical, high, medium, low\n    zone: str\n\n\n@dataclass\nclass OTVulnerability:\n    vuln_id: str\n    cve_id: str\n    title: str\n    severity: str  # critical, high, medium, low\n    cvss_score: float\n    affected_vendor: str\n    affected_product: str\n    affected_versions: str\n    description: str\n    ics_cert_advisory: str = \"\"\n    remediation: str = \"\"\n    patch_available: bool = False\n    compensating_controls: str = \"\"\n\n\n@dataclass\nclass RiskAssessment:\n    asset: OTAsset\n    vulnerability: OTVulnerability\n    risk_score: float = 0.0\n    risk_rating: str = \"\"\n    exploitability: str = \"\"\n    operational_impact: str = \"\"\n    compensating_controls: list = field(default_factory=list)\n    remediation_priority: int = 0\n\n\nclass OTVulnerabilityAssessment:\n    \"\"\"OT vulnerability assessment and prioritization engine.\"\"\"\n\n    def __init__(self):\n        self.assets = []\n        self.vulnerabilities = []\n        self.risk_assessments = []\n\n    def load_assets(self, assets_data):\n        \"\"\"Load asset inventory from Claroty export or manual inventory.\"\"\"\n        for a in assets_data:\n            self.assets.append(OTAsset(**a))\n        print(f\"[*] Loaded {len(self.assets)} OT assets\")\n\n    def fetch_ics_advisories(self):\n        \"\"\"Fetch latest ICS-CERT advisories from CISA.\"\"\"\n        print(\"[*] Fetching ICS-CERT advisories from CISA...\")\n        try:\n            # CISA Known Exploited Vulnerabilities catalog\n            url = \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n            resp = requests.get(url, timeout=30)\n            resp.raise_for_status()\n            data = resp.json()\n\n            ics_vulns = []\n            for vuln in data.get(\"vulnerabilities\", []):\n                # Filter for ICS-relevant vendors\n                ics_vendors = [\n                    \"siemens\", \"schneider\", \"rockwell\", \"honeywell\",\n                    \"abb\", \"ge\", \"emerson\", \"yokogawa\", \"omron\",\n                    \"mitsubishi\", \"phoenix\", \"moxa\", \"advantech\",\n                ]\n                vendor = vuln.get(\"vendorProject\", \"\").lower()\n                if any(v in vendor for v in ics_vendors):\n                    ics_vulns.append(vuln)\n\n            print(f\"  Found {len(ics_vulns)} ICS-relevant known exploited vulnerabilities\")\n            return ics_vulns\n\n        except Exception as e:\n            print(f\"[WARN] Could not fetch advisories: {e}\")\n            return []\n\n    def correlate_vulnerabilities(self):\n        \"\"\"Match vulnerabilities to assets based on vendor\u002Fmodel\u002Ffirmware.\"\"\"\n        print(\"[*] Correlating vulnerabilities to assets...\")\n\n        for asset in self.assets:\n            for vuln in self.vulnerabilities:\n                if (vuln.affected_vendor.lower() in asset.vendor.lower() and\n                    vuln.affected_product.lower() in asset.model.lower()):\n                    # Check firmware version if specified\n                    ra = RiskAssessment(asset=asset, vulnerability=vuln)\n                    self._calculate_risk_score(ra)\n                    self.risk_assessments.append(ra)\n\n        print(f\"  Correlated {len(self.risk_assessments)} asset-vulnerability pairs\")\n\n    def _calculate_risk_score(self, ra):\n        \"\"\"Calculate OT-specific risk score considering operational impact.\"\"\"\n        # Base score from CVSS\n        base = ra.vulnerability.cvss_score\n\n        # Criticality multiplier based on asset function\n        criticality_weights = {\n            \"critical\": 1.5,  # SIS, safety systems\n            \"high\": 1.3,      # PLCs, primary control\n            \"medium\": 1.0,    # HMIs, historians\n            \"low\": 0.7,       # non-critical support systems\n        }\n        criticality = criticality_weights.get(ra.asset.criticality, 1.0)\n\n        # Purdue level proximity factor (lower levels = higher risk)\n        level_weights = {\n            \"Level 0-1\": 1.5,\n            \"Level 2\": 1.3,\n            \"Level 3\": 1.0,\n            \"Level 3.5\": 0.8,\n            \"Level 4\": 0.6,\n        }\n        level_factor = level_weights.get(ra.asset.purdue_level, 1.0)\n\n        # Network exposure reduction if compensating controls exist\n        comp_reduction = 0.8 if ra.compensating_controls else 1.0\n\n        ra.risk_score = round(base * criticality * level_factor * comp_reduction, 1)\n        ra.risk_score = min(ra.risk_score, 10.0)\n\n        if ra.risk_score >= 9.0:\n            ra.risk_rating = \"critical\"\n            ra.remediation_priority = 1\n        elif ra.risk_score >= 7.0:\n            ra.risk_rating = \"high\"\n            ra.remediation_priority = 2\n        elif ra.risk_score >= 4.0:\n            ra.risk_rating = \"medium\"\n            ra.remediation_priority = 3\n        else:\n            ra.risk_rating = \"low\"\n            ra.remediation_priority = 4\n\n    def generate_report(self):\n        \"\"\"Generate vulnerability assessment report.\"\"\"\n        # Sort by risk score descending\n        sorted_ra = sorted(self.risk_assessments, key=lambda x: -x.risk_score)\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT VULNERABILITY ASSESSMENT REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(f\"Assets: {len(self.assets)} | Vulnerabilities: {len(self.vulnerabilities)}\")\n        report.append(f\"Risk Assessments: {len(self.risk_assessments)}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [ra for ra in sorted_ra if ra.risk_rating == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} RISK ({len(findings)}) ---\")\n                for ra in findings[:10]:\n                    report.append(f\"\\n  Risk Score: {ra.risk_score}\u002F10.0\")\n                    report.append(f\"  Asset: {ra.asset.name} ({ra.asset.vendor} {ra.asset.model})\")\n                    report.append(f\"  Zone: {ra.asset.zone} ({ra.asset.purdue_level})\")\n                    report.append(f\"  CVE: {ra.vulnerability.cve_id} (CVSS: {ra.vulnerability.cvss_score})\")\n                    report.append(f\"  Title: {ra.vulnerability.title}\")\n                    if ra.vulnerability.patch_available:\n                        report.append(f\"  Patch: Available - schedule for next maintenance window\")\n                    else:\n                        report.append(f\"  Patch: Not available - apply compensating controls\")\n\n        return \"\\n\".join(report)\n\n    def export_json(self, output_file):\n        \"\"\"Export assessment to JSON.\"\"\"\n        data = {\n            \"assessment_date\": datetime.now().isoformat(),\n            \"asset_count\": len(self.assets),\n            \"vulnerability_count\": len(self.vulnerabilities),\n            \"risk_assessments\": [\n                {\n                    \"asset_name\": ra.asset.name,\n                    \"asset_ip\": ra.asset.ip_address,\n                    \"cve\": ra.vulnerability.cve_id,\n                    \"risk_score\": ra.risk_score,\n                    \"risk_rating\": ra.risk_rating,\n                    \"priority\": ra.remediation_priority,\n                }\n                for ra in sorted(self.risk_assessments, key=lambda x: -x.risk_score)\n            ],\n        }\n        with open(output_file, \"w\") as f:\n            json.dump(data, f, indent=2)\n\n\nif __name__ == \"__main__\":\n    assessment = OTVulnerabilityAssessment()\n    advisories = assessment.fetch_ics_advisories()\n    print(f\"Fetched {len(advisories)} ICS advisories from CISA KEV catalog\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Claroty xDome | Cyber-physical systems protection platform providing asset discovery, vulnerability management, and threat detection for OT\u002FIoT environments |\n| Passive Discovery | Identifying OT assets by analyzing network traffic without sending any packets, safe for production environments |\n| Safe Active Query | Querying OT devices using native industrial protocols at safe rates to collect detailed asset information without disrupting operations |\n| OT Risk Score | Risk rating that factors CVSS base score, asset criticality, Purdue level, and compensating controls for OT-appropriate prioritization |\n| ICS-CERT Advisory | CISA-published security advisories for industrial control system vulnerabilities with vendor-specific remediation guidance |\n| Virtual Patching | Deploying IPS\u002Ffirewall rules to block exploitation of known vulnerabilities when firmware patches cannot be immediately applied |\n\n## Tools & Systems\n\n- **Claroty xDome**: Comprehensive OT\u002FIoT asset discovery, vulnerability management, and continuous threat detection platform\n- **Claroty CTD**: Continuous Threat Detection sensor for passive network monitoring in OT environments\n- **CISA ICS-CERT**: US government advisory service publishing ICS vulnerability notifications and mitigation guidance\n- **Dragos Platform**: Alternative OT security platform with asset visibility and vulnerability management capabilities\n- **Nozomi Networks Guardian**: OT monitoring platform with vulnerability correlation and risk scoring\n\n## Output Format\n\n```\nOT Vulnerability Assessment Report\n=====================================\nTool: Claroty xDome \u002F Manual Assessment\nDate: YYYY-MM-DD\nAssets Scanned: [N]\n\nRISK SUMMARY:\n  Critical Risk: [N] vulnerabilities on [N] assets\n  High Risk: [N] vulnerabilities on [N] assets\n  Medium Risk: [N] vulnerabilities on [N] assets\n  Low Risk: [N] vulnerabilities on [N] assets\n\nTOP RISKS:\n  [Risk Score] [CVE-ID] on [Asset Name] ([Zone])\n    Remediation: [Patch\u002FCompensating Control]\n    Timeline: [Next maintenance window \u002F Immediate]\n```\n",{"name":5,"tags":52,"author":58,"domain":44,"license":15,"version":59,"nist_csf":60,"subdomain":65,"description":7,"mitre_attack":66},[37,53,54,55,56,57,29],"ics","scada","industrial-control","iec62443","vulnerability-assessment","mahipal","1.0.0",[61,62,63,64],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security",[67,68,69,70,71],"T1078","T1190","T1059","T0816","T0836","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-ot-vulnerability-assessment-with-claroty",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ot-vulnerability-assessment-with-claroty",{"tool":88,"command":89},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ot-vulnerability-assessment-with-claroty",{"tool":91,"command":92},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-ot-vulnerability-assessment-with-claroty","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ot-vulnerability-assessment-with-claroty\u002FSKILL.md",true,[96,101,107],{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ot-vulnerability-assessment-with-claroty\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",1166,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ot-vulnerability-assessment-with-claroty\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fagent.py","SCRIPT","脚本",5473,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-ot-vulnerability-assessment-with-claroty\u002Fscripts\u002Fagent.py",[114,139,163,187,213,237],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":121,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[120],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[122,123,124,125,45,44,126,127,42,128,129,130,131,132,133,134,135,136,137,138],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[145],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[147,135,148,149,45,150,44,42,151,152,153,154,155,156,157,158,159,160,161,162],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":171,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[169,170],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[157,172,173,174,38,44,175,176,151,177,178,179,180,181,182,36,183,184,185,186],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[193],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,44,198,199,200,201,202,203,204,205,206,207,208,209,154,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,44,224,225,226,227,228,229,230,231,232,31,34,28,233,234,235,236],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","api","prioritization","ssvc","decision-tree",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[243],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[45,245,44,246,247,248,249,250,251,252,253,36,254,183,255,256,257,258,259,260],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]