[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYHT7KCJB231Z43DJRQZFN":3,"skill-same:01M6GYHT7KCJB231Z43DJRQZFN":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6GYHT7KCJB231Z43DJRQZFN","implementing-microsegmentation-with-guardicore",null,"Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"guardicore","implementing","with","implementing microsegmentation with guardicore","microsegmentation","least-privilege","lateral-movement","zero-trust","network","segmentation","cybersecurity","akamai","east-west-traffic","communication","map","across","flows","create","traffic","architecture","2026-11-10 10:12:30",false,"---\nname: implementing-microsegmentation-with-guardicore\ndescription: >\n  Implementing microsegmentation using Akamai Guardicore Segmentation to map application\n  dependencies, create granular network policies, visualize east-west traffic flows,\n  and enforce least-privilege communication between workloads across data centers and cloud.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags: [microsegmentation, guardicore, akamai, zero-trust, east-west-traffic, network-segmentation, lateral-movement]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Implementing Microsegmentation with Guardicore\n\n## When to Use\n\n- When implementing east-west traffic controls to prevent lateral movement within data centers\n- When needing application-level visibility into network communication patterns before writing segmentation policies\n- When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)\n- When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation\n- When deploying zero trust at the network layer with process-level granularity\n\n**Do not use** for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs\u002Fsecurity groups suffice, or when network team lacks capacity for ongoing policy management.\n\n## Prerequisites\n\n- Akamai Guardicore Segmentation license (Enterprise or Premium)\n- Guardicore Management Server deployed (on-prem or SaaS)\n- Agent deployment access to target workloads (Linux, Windows, Kubernetes)\n- Network visibility: SPAN\u002FTAP ports or VPC flow logs for agentless collection\n- Application owner engagement for dependency validation\n\n## Workflow\n\n### Step 1: Deploy Guardicore Agents on Workloads\n\nInstall agents to collect process-level network communication data.\n\n```bash\n# Linux agent installation\ncurl -sSL https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Flinux \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -o gc-agent-installer.sh\nchmod +x gc-agent-installer.sh\nsudo .\u002Fgc-agent-installer.sh \\\n  --management-url=https:\u002F\u002Fmanagement.guardicore.com \\\n  --site-id=datacenter-east \\\n  --label=\"web-tier\"\n\n# Windows agent installation (PowerShell)\n# Invoke-WebRequest -Uri \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Fwindows\" `\n#   -Headers @{\"Authorization\"=\"Bearer $GC_API_TOKEN\"} `\n#   -OutFile gc-agent-installer.exe\n# Start-Process -FilePath .\\gc-agent-installer.exe `\n#   -ArgumentList \"--management-url=https:\u002F\u002Fmanagement.guardicore.com\",\"--site-id=datacenter-east\" `\n#   -Wait\n\n# Kubernetes DaemonSet deployment\ncat > gc-daemonset.yaml \u003C\u003C 'EOF'\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: guardicore-agent\n  namespace: guardicore\nspec:\n  selector:\n    matchLabels:\n      app: gc-agent\n  template:\n    metadata:\n      labels:\n        app: gc-agent\n    spec:\n      hostNetwork: true\n      hostPID: true\n      containers:\n      - name: gc-agent\n        image: guardicore\u002Fagent:latest\n        securityContext:\n          privileged: true\n        env:\n        - name: GC_MANAGEMENT_URL\n          value: \"https:\u002F\u002Fmanagement.guardicore.com\"\n        - name: GC_API_KEY\n          valueFrom:\n            secretKeyRef:\n              name: gc-credentials\n              key: api-key\n        volumeMounts:\n        - mountPath: \u002Fhost\n          name: host-root\n      volumes:\n      - name: host-root\n        hostPath:\n          path: \u002F\nEOF\nkubectl apply -f gc-daemonset.yaml\n\n# Verify agent enrollment\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents?status=active\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" | python3 -m json.tool\n```\n\n### Step 2: Map Application Dependencies with Reveal\n\nUse Guardicore Reveal to discover and visualize application communication patterns.\n\n```bash\n# Query discovered application flows via API\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fconnections\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": {\"from\": \"2026-02-17T00:00:00Z\", \"to\": \"2026-02-24T00:00:00Z\"},\n    \"filter\": {\n      \"source_label\": \"web-tier\",\n      \"destination_label\": \"app-tier\"\n    },\n    \"aggregation\": \"process\",\n    \"limit\": 1000\n  }' | python3 -m json.tool\n\n# Export application dependency map\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fmaps\u002Fexport\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"format\": \"json\",\n    \"labels\": [\"web-tier\", \"app-tier\", \"db-tier\"],\n    \"time_range\": \"7d\"\n  }' -o app-dependency-map.json\n\n# Typical discovery findings:\n# web-tier -> app-tier: TCP 8080, 8443 (expected)\n# app-tier -> db-tier: TCP 5432, 3306 (expected)\n# web-tier -> db-tier: TCP 5432 (UNEXPECTED - should be blocked)\n# app-tier -> internet: TCP 443 (verify if needed)\n```\n\n### Step 3: Create Segmentation Labels and Policies\n\nDefine labels and create ring-fence policies around applications.\n\n```bash\n# Create labels for application tiers\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Flabels\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI-CDE\",\n    \"description\": \"Cardholder Data Environment workloads\",\n    \"criteria\": {\"ip_ranges\": [\"10.10.0.0\u002F16\"]},\n    \"color\": \"#FF0000\"\n  }'\n\n# Create segmentation policy: Allow web-to-app communication\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Web-to-App Allowed\",\n    \"action\": \"ALLOW\",\n    \"priority\": 100,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"app-tier\"]},\n    \"services\": [\n      {\"protocol\": \"TCP\", \"port\": 8080},\n      {\"protocol\": \"TCP\", \"port\": 8443}\n    ],\n    \"log\": true,\n    \"enabled\": true,\n    \"section\": \"application-segmentation\"\n  }'\n\n# Create deny policy: Block web-to-database direct access\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Block Web-to-DB Direct\",\n    \"action\": \"DENY\",\n    \"priority\": 200,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"db-tier\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n\n# Create ring-fence policy for PCI CDE\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI CDE Ring Fence\",\n    \"action\": \"DENY\",\n    \"priority\": 50,\n    \"source\": {\"labels\": [\"!PCI-CDE\"]},\n    \"destination\": {\"labels\": [\"PCI-CDE\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n```\n\n### Step 4: Test Policies in Reveal Mode Before Enforcement\n\nSimulate policy enforcement without blocking traffic.\n\n```bash\n# Enable reveal mode (log-only) for new policies\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"REVEAL\"}'\n\n# Check what would be blocked in reveal mode\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fviolations\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": \"24h\",\n    \"policy_id\": \"POLICY_ID\",\n    \"limit\": 100\n  }' | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor v in data.get('violations', []):\n    print(f\\\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\\\")\n\"\n\n# After validation, switch to enforcement\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"ENFORCE\"}'\n```\n\n### Step 5: Monitor and Respond to Policy Violations\n\nSet up alerting and continuous monitoring for segmentation violations.\n\n```bash\n# Configure SIEM integration for policy violations\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fintegrations\u002Fsyslog\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Splunk SIEM\",\n    \"host\": \"splunk-syslog.company.com\",\n    \"port\": 514,\n    \"protocol\": \"TCP\",\n    \"format\": \"CEF\",\n    \"events\": [\"policy_violation\", \"agent_status\", \"deception_alert\"]\n  }'\n\n# Splunk query for microsegmentation violations\n# index=guardicore sourcetype=guardicore:policy\n# | where action=\"DENY\" AND enforcement_mode=\"ENFORCE\"\n# | stats count by src_ip, dst_ip, dst_port, policy_name\n# | sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsegmentation | Network security technique creating granular security zones around individual workloads or applications to control east-west traffic |\n| Reveal Mode | Guardicore's simulation mode that logs policy decisions without enforcing them, allowing validation before blocking |\n| Ring-Fence Policy | Isolation policy that restricts all traffic into or out of a defined group of assets (e.g., PCI CDE) |\n| Application Dependency Map | Visual representation of discovered network communication patterns between workloads showing processes, ports, and protocols |\n| East-West Traffic | Network traffic flowing laterally between workloads within a data center, as opposed to north-south traffic crossing the perimeter |\n| Process-Level Visibility | Guardicore's ability to identify which process on a workload initiated or received a network connection |\n\n## Tools & Systems\n\n- **Akamai Guardicore Segmentation**: Agent-based microsegmentation platform with application visualization and policy enforcement\n- **Guardicore Reveal**: Network visualization engine mapping application dependencies across hybrid environments\n- **Guardicore Centra**: Management console for policy creation, monitoring, and incident investigation\n- **Guardicore Agents**: Lightweight agents deployed on workloads collecting process-level network telemetry\n- **Guardicore Insight**: Analytics engine for compliance reporting and segmentation effectiveness measurement\n\n## Common Scenarios\n\n### Scenario: PCI DSS Microsegmentation for E-Commerce Platform\n\n**Context**: An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.\n\n**Approach**:\n1. Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers\n2. Run Reveal for 2 weeks to map all communication patterns into and out of the CDE\n3. Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)\n4. Create ring-fence policy blocking all non-CDE to CDE traffic by default\n5. Create explicit allow policies for validated CDE communication paths\n6. Test in Reveal mode for 1 week, validate no legitimate traffic blocked\n7. Switch to enforcement mode and monitor for violations\n8. Generate PCI DSS segmentation validation report showing enforced controls\n\n**Pitfalls**: Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.\n\n## Output Format\n\n```\nMicrosegmentation Deployment Report\n==================================================\nOrganization: E-Commerce Corp\nReport Date: 2026-02-23\n\nAGENT DEPLOYMENT:\n  Total workloads:            500\n  Agents installed:           487 (97.4%)\n  Agents active:              482 (98.9%)\n  Agentless (flow logs):       13\n\nPOLICY COVERAGE:\n  Total policies:              45\n  Allow rules:                 38\n  Deny rules:                   7\n  Reveal mode:                  3\n  Enforced:                    42\n\nTRAFFIC ANALYSIS (7 days):\n  Total flows observed:        2,456,789\n  Flows matching allow:        2,441,234 (99.4%)\n  Flows matching deny:            15,555 (0.6%)\n  Unclassified flows:                 0\n\nPCI CDE ISOLATION:\n  CDE workloads:               200\n  Ring-fence violations:         0 (last 30 days)\n  Authorized CDE entry points:  4\n  Lateral movement paths blocked: 95%\n```\n","# Implementing Microsegmentation with Guardicore\n\n## When to Use\n\n- When implementing east-west traffic controls to prevent lateral movement within data centers\n- When needing application-level visibility into network communication patterns before writing segmentation policies\n- When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)\n- When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation\n- When deploying zero trust at the network layer with process-level granularity\n\n**Do not use** for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs\u002Fsecurity groups suffice, or when network team lacks capacity for ongoing policy management.\n\n## Prerequisites\n\n- Akamai Guardicore Segmentation license (Enterprise or Premium)\n- Guardicore Management Server deployed (on-prem or SaaS)\n- Agent deployment access to target workloads (Linux, Windows, Kubernetes)\n- Network visibility: SPAN\u002FTAP ports or VPC flow logs for agentless collection\n- Application owner engagement for dependency validation\n\n## Workflow\n\n### Step 1: Deploy Guardicore Agents on Workloads\n\nInstall agents to collect process-level network communication data.\n\n```bash\n# Linux agent installation\ncurl -sSL https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Flinux \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -o gc-agent-installer.sh\nchmod +x gc-agent-installer.sh\nsudo .\u002Fgc-agent-installer.sh \\\n  --management-url=https:\u002F\u002Fmanagement.guardicore.com \\\n  --site-id=datacenter-east \\\n  --label=\"web-tier\"\n\n# Windows agent installation (PowerShell)\n# Invoke-WebRequest -Uri \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents\u002Fdownload\u002Fwindows\" `\n#   -Headers @{\"Authorization\"=\"Bearer $GC_API_TOKEN\"} `\n#   -OutFile gc-agent-installer.exe\n# Start-Process -FilePath .\\gc-agent-installer.exe `\n#   -ArgumentList \"--management-url=https:\u002F\u002Fmanagement.guardicore.com\",\"--site-id=datacenter-east\" `\n#   -Wait\n\n# Kubernetes DaemonSet deployment\ncat > gc-daemonset.yaml \u003C\u003C 'EOF'\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n  name: guardicore-agent\n  namespace: guardicore\nspec:\n  selector:\n    matchLabels:\n      app: gc-agent\n  template:\n    metadata:\n      labels:\n        app: gc-agent\n    spec:\n      hostNetwork: true\n      hostPID: true\n      containers:\n      - name: gc-agent\n        image: guardicore\u002Fagent:latest\n        securityContext:\n          privileged: true\n        env:\n        - name: GC_MANAGEMENT_URL\n          value: \"https:\u002F\u002Fmanagement.guardicore.com\"\n        - name: GC_API_KEY\n          valueFrom:\n            secretKeyRef:\n              name: gc-credentials\n              key: api-key\n        volumeMounts:\n        - mountPath: \u002Fhost\n          name: host-root\n      volumes:\n      - name: host-root\n        hostPath:\n          path: \u002F\nEOF\nkubectl apply -f gc-daemonset.yaml\n\n# Verify agent enrollment\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fagents?status=active\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" | python3 -m json.tool\n```\n\n### Step 2: Map Application Dependencies with Reveal\n\nUse Guardicore Reveal to discover and visualize application communication patterns.\n\n```bash\n# Query discovered application flows via API\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fconnections\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": {\"from\": \"2026-02-17T00:00:00Z\", \"to\": \"2026-02-24T00:00:00Z\"},\n    \"filter\": {\n      \"source_label\": \"web-tier\",\n      \"destination_label\": \"app-tier\"\n    },\n    \"aggregation\": \"process\",\n    \"limit\": 1000\n  }' | python3 -m json.tool\n\n# Export application dependency map\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fmaps\u002Fexport\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"format\": \"json\",\n    \"labels\": [\"web-tier\", \"app-tier\", \"db-tier\"],\n    \"time_range\": \"7d\"\n  }' -o app-dependency-map.json\n\n# Typical discovery findings:\n# web-tier -> app-tier: TCP 8080, 8443 (expected)\n# app-tier -> db-tier: TCP 5432, 3306 (expected)\n# web-tier -> db-tier: TCP 5432 (UNEXPECTED - should be blocked)\n# app-tier -> internet: TCP 443 (verify if needed)\n```\n\n### Step 3: Create Segmentation Labels and Policies\n\nDefine labels and create ring-fence policies around applications.\n\n```bash\n# Create labels for application tiers\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Flabels\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI-CDE\",\n    \"description\": \"Cardholder Data Environment workloads\",\n    \"criteria\": {\"ip_ranges\": [\"10.10.0.0\u002F16\"]},\n    \"color\": \"#FF0000\"\n  }'\n\n# Create segmentation policy: Allow web-to-app communication\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Web-to-App Allowed\",\n    \"action\": \"ALLOW\",\n    \"priority\": 100,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"app-tier\"]},\n    \"services\": [\n      {\"protocol\": \"TCP\", \"port\": 8080},\n      {\"protocol\": \"TCP\", \"port\": 8443}\n    ],\n    \"log\": true,\n    \"enabled\": true,\n    \"section\": \"application-segmentation\"\n  }'\n\n# Create deny policy: Block web-to-database direct access\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Block Web-to-DB Direct\",\n    \"action\": \"DENY\",\n    \"priority\": 200,\n    \"source\": {\"labels\": [\"web-tier\"]},\n    \"destination\": {\"labels\": [\"db-tier\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n\n# Create ring-fence policy for PCI CDE\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"PCI CDE Ring Fence\",\n    \"action\": \"DENY\",\n    \"priority\": 50,\n    \"source\": {\"labels\": [\"!PCI-CDE\"]},\n    \"destination\": {\"labels\": [\"PCI-CDE\"]},\n    \"services\": [{\"protocol\": \"TCP\", \"port_range\": \"1-65535\"}],\n    \"log\": true,\n    \"alert\": true,\n    \"enabled\": true\n  }'\n```\n\n### Step 4: Test Policies in Reveal Mode Before Enforcement\n\nSimulate policy enforcement without blocking traffic.\n\n```bash\n# Enable reveal mode (log-only) for new policies\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"REVEAL\"}'\n\n# Check what would be blocked in reveal mode\ncurl -s \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fviolations\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"time_range\": \"24h\",\n    \"policy_id\": \"POLICY_ID\",\n    \"limit\": 100\n  }' | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor v in data.get('violations', []):\n    print(f\\\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\\\")\n\"\n\n# After validation, switch to enforcement\ncurl -X PATCH \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fpolicies\u002FPOLICY_ID\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\"enforcement_mode\": \"ENFORCE\"}'\n```\n\n### Step 5: Monitor and Respond to Policy Violations\n\nSet up alerting and continuous monitoring for segmentation violations.\n\n```bash\n# Configure SIEM integration for policy violations\ncurl -X POST \"https:\u002F\u002Fmanagement.guardicore.com\u002Fapi\u002Fv3.0\u002Fintegrations\u002Fsyslog\" \\\n  -H \"Authorization: Bearer ${GC_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Splunk SIEM\",\n    \"host\": \"splunk-syslog.company.com\",\n    \"port\": 514,\n    \"protocol\": \"TCP\",\n    \"format\": \"CEF\",\n    \"events\": [\"policy_violation\", \"agent_status\", \"deception_alert\"]\n  }'\n\n# Splunk query for microsegmentation violations\n# index=guardicore sourcetype=guardicore:policy\n# | where action=\"DENY\" AND enforcement_mode=\"ENFORCE\"\n# | stats count by src_ip, dst_ip, dst_port, policy_name\n# | sort -count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Microsegmentation | Network security technique creating granular security zones around individual workloads or applications to control east-west traffic |\n| Reveal Mode | Guardicore's simulation mode that logs policy decisions without enforcing them, allowing validation before blocking |\n| Ring-Fence Policy | Isolation policy that restricts all traffic into or out of a defined group of assets (e.g., PCI CDE) |\n| Application Dependency Map | Visual representation of discovered network communication patterns between workloads showing processes, ports, and protocols |\n| East-West Traffic | Network traffic flowing laterally between workloads within a data center, as opposed to north-south traffic crossing the perimeter |\n| Process-Level Visibility | Guardicore's ability to identify which process on a workload initiated or received a network connection |\n\n## Tools & Systems\n\n- **Akamai Guardicore Segmentation**: Agent-based microsegmentation platform with application visualization and policy enforcement\n- **Guardicore Reveal**: Network visualization engine mapping application dependencies across hybrid environments\n- **Guardicore Centra**: Management console for policy creation, monitoring, and incident investigation\n- **Guardicore Agents**: Lightweight agents deployed on workloads collecting process-level network telemetry\n- **Guardicore Insight**: Analytics engine for compliance reporting and segmentation effectiveness measurement\n\n## Common Scenarios\n\n### Scenario: PCI DSS Microsegmentation for E-Commerce Platform\n\n**Context**: An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.\n\n**Approach**:\n1. Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers\n2. Run Reveal for 2 weeks to map all communication patterns into and out of the CDE\n3. Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)\n4. Create ring-fence policy blocking all non-CDE to CDE traffic by default\n5. Create explicit allow policies for validated CDE communication paths\n6. Test in Reveal mode for 1 week, validate no legitimate traffic blocked\n7. Switch to enforcement mode and monitor for violations\n8. Generate PCI DSS segmentation validation report showing enforced controls\n\n**Pitfalls**: Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.\n\n## Output Format\n\n```\nMicrosegmentation Deployment Report\n==================================================\nOrganization: E-Commerce Corp\nReport Date: 2026-02-23\n\nAGENT DEPLOYMENT:\n  Total workloads:            500\n  Agents installed:           487 (97.4%)\n  Agents active:              482 (98.9%)\n  Agentless (flow logs):       13\n\nPOLICY COVERAGE:\n  Total policies:              45\n  Allow rules:                 38\n  Deny rules:                   7\n  Reveal mode:                  3\n  Enforced:                    42\n\nTRAFFIC ANALYSIS (7 days):\n  Total flows observed:        2,456,789\n  Flows matching allow:        2,441,234 (99.4%)\n  Flows matching deny:            15,555 (0.6%)\n  Unclassified flows:                 0\n\nPCI CDE ISOLATION:\n  CDE workloads:               200\n  Ring-fence violations:         0 (last 30 days)\n  Authorized CDE entry points:  4\n  Lateral movement paths blocked: 95%\n```\n",{"name":5,"tags":43,"author":45,"domain":28,"license":14,"version":46,"subdomain":47,"description":48},[22,18,29,25,30,44,24],"network-segmentation","mahipal","1.0","zero-trust-architecture","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add micsapp\u002Fmicstec-skills --skill implementing-microsegmentation-with-guardicore",{"tool":62,"command":63},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill implementing-microsegmentation-with-guardicore",{"tool":65,"command":66},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill implementing-microsegmentation-with-guardicore","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",true,[70,75,81],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",1687,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",5908,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002Fscripts\u002Fagent.py",[88,124,153,174,194,218],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":105,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[95,100],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[37,106,107,108,109,110,111,112,26,113,114,115,116,117,118,119,120,121,122,123],"azure","azure apim architecture","component","authentication","gateway","topology","Optimization","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":138,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[130,131,134,137],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":132,"categoryName":133,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":135,"categoryName":136,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[139,140,141,142,106,143,144,145,146,147,148,149,113,114,120,150,151,121,152,19],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[159],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},[161,162,163,164,106,109,113,114,165,166,167,168,169,170,171,121,172,173,19,123],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":182,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[180,181],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[183,164,184,113,168,185,106,139,186,187,188,189,114,190,121,191,192,193,122,123],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[201,202,203,141,204,205,35,206,113,207,208,209,210,211,212,213,214,215,216,217],"cli","jira","jira cli","init","tasks","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":224,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[220,225,226,227,228,229,230,166,231,232],"npm","js","calculate","node","math","user","compute","errors"]