[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYMBP2ZMS7DMNBCB5G15RH":3,"skill-same:01M6GYMBP2ZMS7DMNBCB5G15RH":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":76},"01M6GYMBP2ZMS7DMNBCB5G15RH","implementing-ot-network-traffic-analysis-with-nozomi",null,"Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across industrial control systems without disrupting operations, leveraging behavioral anomaly detection and protocol-aware monitoring.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"implementing","network","traffic","with","traffic analysis","analysis","nozomi","implementing ot network traffic analysis with nozomi","for","cybersecurity","time","vulnerability","ndr","networks","real-time","ics","ot-security","network-monitoring","monitoring","assessment","2026-11-10 10:12:30",false,"---\nname: implementing-ot-network-traffic-analysis-with-nozomi\ndescription: >\n  Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis\n  to achieve comprehensive asset visibility, real-time threat detection, and\n  vulnerability assessment across industrial control systems without disrupting\n  operations, leveraging behavioral anomaly detection and protocol-aware monitoring.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags: [ot-security, ics, nozomi, guardian, network-monitoring, asset-visibility, anomaly-detection, ndr]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Implementing OT Network Traffic Analysis with Nozomi\n\n## When to Use\n\n- When deploying passive OT network monitoring using Nozomi Networks Guardian sensors\n- When requiring asset visibility without active scanning in sensitive ICS environments\n- When building a Nozomi-based OT SOC with centralized management via Vantage or CMC\n- When integrating OT network monitoring with Fortinet, Splunk, or ServiceNow ecosystems\n- When monitoring compliance with IEC 62443 network segmentation policies\n\n**Do not use** for active vulnerability scanning of OT devices (see performing-ot-vulnerability-scanning-safely), for environments standardized on Dragos (see implementing-dragos-platform-for-ot-monitoring), or for IT-only network monitoring.\n\n## Prerequisites\n\n- Nozomi Networks Guardian sensor (hardware, VM, or container)\n- Network TAP or SPAN port configured on monitored OT network segments\n- Nozomi Vantage (cloud) or Central Management Console for multi-sensor management\n- Nozomi Threat Intelligence subscription for updated detection signatures\n- Network architecture documentation for sensor placement planning\n\n## Workflow\n\n### Step 1: Deploy Guardian Sensors for Passive Monitoring\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Nozomi Guardian Deployment Manager and Alert Analyzer.\n\nManages Nozomi Guardian sensor deployment validation, asset inventory\nextraction, and threat alert analysis for OT environments.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass NozomiGuardianManager:\n    \"\"\"Manages Nozomi Networks Guardian for OT monitoring.\"\"\"\n\n    def __init__(self, guardian_url: str, api_token: str, verify_ssl: bool = False):\n        self.guardian_url = guardian_url.rstrip(\"\u002F\")\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Authorization\": f\"Bearer {api_token}\",\n            \"Content-Type\": \"application\u002Fjson\",\n        })\n        self.session.verify = verify_ssl\n\n    def get_nodes(self, node_type: Optional[str] = None) -> List[Dict]:\n        \"\"\"Retrieve discovered network nodes (assets).\"\"\"\n        params = {}\n        if node_type:\n            params[\"type\"] = node_type\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fnodes\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_alerts(self, severity: str = \"high\", limit: int = 100) -> List[Dict]:\n        \"\"\"Retrieve security alerts.\"\"\"\n        params = {\"severity\": severity, \"limit\": limit, \"status\": \"open\"}\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Falerts\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_links(self) -> List[Dict]:\n        \"\"\"Retrieve communication links between nodes.\"\"\"\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Flinks\")\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_vulnerabilities(self) -> List[Dict]:\n        \"\"\"Retrieve detected vulnerabilities.\"\"\"\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fvulnerabilities\")\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def validate_deployment(self):\n        \"\"\"Validate Guardian sensor deployment and coverage.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"NOZOMI GUARDIAN DEPLOYMENT VALIDATION\")\n        print(f\"{'='*65}\")\n        print(f\"Guardian URL: {self.guardian_url}\")\n        print(f\"Validation Time: {datetime.now().isoformat()}\")\n\n        # Check system status\n        try:\n            resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fsystem\u002Fstatus\")\n            if resp.status_code == 200:\n                status = resp.json()\n                print(f\"\\n--- SYSTEM STATUS ---\")\n                print(f\"  Version: {status.get('version', 'N\u002FA')}\")\n                print(f\"  Uptime: {status.get('uptime', 'N\u002FA')}\")\n                print(f\"  Packets Processed: {status.get('packets_processed', 'N\u002FA')}\")\n                print(f\"  Threat Intelligence: {status.get('threat_intelligence_version', 'N\u002FA')}\")\n        except requests.RequestException as e:\n            print(f\"  [!] System status unavailable: {e}\")\n\n        # Asset discovery summary\n        nodes = self.get_nodes()\n        print(f\"\\n--- ASSET DISCOVERY ---\")\n        print(f\"  Total Nodes Discovered: {len(nodes)}\")\n\n        type_counts = defaultdict(int)\n        vendor_counts = defaultdict(int)\n        protocol_set = set()\n        for node in nodes:\n            type_counts[node.get(\"type\", \"unknown\")] += 1\n            vendor_counts[node.get(\"vendor\", \"Unknown\")] += 1\n            for proto in node.get(\"protocols\", []):\n                protocol_set.add(proto)\n\n        print(f\"\\n  By Type:\")\n        for ntype, count in sorted(type_counts.items(), key=lambda x: -x[1]):\n            print(f\"    {ntype}: {count}\")\n\n        print(f\"\\n  By Vendor:\")\n        for vendor, count in sorted(vendor_counts.items(), key=lambda x: -x[1])[:10]:\n            print(f\"    {vendor}: {count}\")\n\n        print(f\"\\n  Protocols Observed: {', '.join(sorted(protocol_set))}\")\n\n        # Alert summary\n        alerts = self.get_alerts(severity=\"high\")\n        print(f\"\\n--- ALERT SUMMARY ---\")\n        print(f\"  High\u002FCritical Alerts: {len(alerts)}\")\n\n        alert_types = defaultdict(int)\n        for alert in alerts:\n            alert_types[alert.get(\"type_id\", \"unknown\")] += 1\n\n        for atype, count in sorted(alert_types.items(), key=lambda x: -x[1])[:10]:\n            print(f\"    {atype}: {count}\")\n\n        # Vulnerability summary\n        vulns = self.get_vulnerabilities()\n        print(f\"\\n--- VULNERABILITY SUMMARY ---\")\n        print(f\"  Total Vulnerabilities: {len(vulns)}\")\n\n        sev_counts = defaultdict(int)\n        for vuln in vulns:\n            sev_counts[vuln.get(\"severity\", \"unknown\")] += 1\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            if sev in sev_counts:\n                print(f\"    {sev.capitalize()}: {sev_counts[sev]}\")\n\n    def analyze_communication_patterns(self):\n        \"\"\"Analyze OT communication patterns for anomalies.\"\"\"\n        links = self.get_links()\n        nodes = {n.get(\"id\"): n for n in self.get_nodes()}\n\n        print(f\"\\n--- COMMUNICATION ANALYSIS ---\")\n        print(f\"  Total Communication Links: {len(links)}\")\n\n        # Identify cross-zone communications\n        cross_zone = []\n        for link in links:\n            src_node = nodes.get(link.get(\"source_id\"), {})\n            dst_node = nodes.get(link.get(\"destination_id\"), {})\n            src_zone = src_node.get(\"zone\", \"unknown\")\n            dst_zone = dst_node.get(\"zone\", \"unknown\")\n\n            if src_zone != dst_zone and src_zone != \"unknown\" and dst_zone != \"unknown\":\n                cross_zone.append({\n                    \"source\": src_node.get(\"label\", \"Unknown\"),\n                    \"source_zone\": src_zone,\n                    \"destination\": dst_node.get(\"label\", \"Unknown\"),\n                    \"dest_zone\": dst_zone,\n                    \"protocols\": link.get(\"protocols\", []),\n                })\n\n        if cross_zone:\n            print(f\"\\n  Cross-Zone Communications: {len(cross_zone)}\")\n            for comm in cross_zone[:10]:\n                print(f\"    {comm['source']} ({comm['source_zone']}) -> \"\n                      f\"{comm['destination']} ({comm['dest_zone']}) \"\n                      f\"via {', '.join(comm['protocols'])}\")\n\n\nif __name__ == \"__main__\":\n    manager = NozomiGuardianManager(\n        guardian_url=\"https:\u002F\u002Fnozomi-guardian.plant.local\",\n        api_token=\"your-api-token\",\n    )\n\n    manager.validate_deployment()\n    manager.analyze_communication_patterns()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Guardian | Nozomi Networks passive sensor that monitors OT network traffic via SPAN\u002FTAP without generating additional traffic |\n| Vantage | Nozomi cloud-based central management platform for aggregating data across multiple Guardian sensors |\n| Behavioral Anomaly Detection (BAD) | Nozomi's AI-driven approach to detecting deviations from learned normal OT network behavior |\n| Smart Polling | Nozomi's active query feature using native protocols to safely extract additional device details |\n| Asset Intelligence | Nozomi's automatic identification and classification of OT\u002FIoT assets from network traffic |\n| Threat Intelligence Feed | Nozomi Labs-maintained feed of OT-specific threat indicators, updated based on global honeypot data |\n\n## Output Format\n\n```\nNOZOMI GUARDIAN OT MONITORING REPORT\n=======================================\nSite: [site name]\nDate: YYYY-MM-DD\n\nASSET VISIBILITY:\n  Total Assets: [count]\n  PLCs: [count] | HMIs: [count] | Switches: [count]\n  Protocols: [list]\n  Vendors: [top 5]\n\nTHREAT DETECTION:\n  Critical Alerts: [count]\n  High Alerts: [count]\n  Top Alert Categories: [list]\n\nVULNERABILITIES:\n  Critical: [count]\n  High: [count]\n\nNETWORK ANALYSIS:\n  Communication Links: [count]\n  Cross-Zone Flows: [count]\n```\n","# Implementing OT Network Traffic Analysis with Nozomi\n\n## When to Use\n\n- When deploying passive OT network monitoring using Nozomi Networks Guardian sensors\n- When requiring asset visibility without active scanning in sensitive ICS environments\n- When building a Nozomi-based OT SOC with centralized management via Vantage or CMC\n- When integrating OT network monitoring with Fortinet, Splunk, or ServiceNow ecosystems\n- When monitoring compliance with IEC 62443 network segmentation policies\n\n**Do not use** for active vulnerability scanning of OT devices (see performing-ot-vulnerability-scanning-safely), for environments standardized on Dragos (see implementing-dragos-platform-for-ot-monitoring), or for IT-only network monitoring.\n\n## Prerequisites\n\n- Nozomi Networks Guardian sensor (hardware, VM, or container)\n- Network TAP or SPAN port configured on monitored OT network segments\n- Nozomi Vantage (cloud) or Central Management Console for multi-sensor management\n- Nozomi Threat Intelligence subscription for updated detection signatures\n- Network architecture documentation for sensor placement planning\n\n## Workflow\n\n### Step 1: Deploy Guardian Sensors for Passive Monitoring\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Nozomi Guardian Deployment Manager and Alert Analyzer.\n\nManages Nozomi Guardian sensor deployment validation, asset inventory\nextraction, and threat alert analysis for OT environments.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass NozomiGuardianManager:\n    \"\"\"Manages Nozomi Networks Guardian for OT monitoring.\"\"\"\n\n    def __init__(self, guardian_url: str, api_token: str, verify_ssl: bool = False):\n        self.guardian_url = guardian_url.rstrip(\"\u002F\")\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Authorization\": f\"Bearer {api_token}\",\n            \"Content-Type\": \"application\u002Fjson\",\n        })\n        self.session.verify = verify_ssl\n\n    def get_nodes(self, node_type: Optional[str] = None) -> List[Dict]:\n        \"\"\"Retrieve discovered network nodes (assets).\"\"\"\n        params = {}\n        if node_type:\n            params[\"type\"] = node_type\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fnodes\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_alerts(self, severity: str = \"high\", limit: int = 100) -> List[Dict]:\n        \"\"\"Retrieve security alerts.\"\"\"\n        params = {\"severity\": severity, \"limit\": limit, \"status\": \"open\"}\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Falerts\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_links(self) -> List[Dict]:\n        \"\"\"Retrieve communication links between nodes.\"\"\"\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Flinks\")\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def get_vulnerabilities(self) -> List[Dict]:\n        \"\"\"Retrieve detected vulnerabilities.\"\"\"\n        resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fvulnerabilities\")\n        resp.raise_for_status()\n        return resp.json().get(\"result\", [])\n\n    def validate_deployment(self):\n        \"\"\"Validate Guardian sensor deployment and coverage.\"\"\"\n        print(f\"\\n{'='*65}\")\n        print(\"NOZOMI GUARDIAN DEPLOYMENT VALIDATION\")\n        print(f\"{'='*65}\")\n        print(f\"Guardian URL: {self.guardian_url}\")\n        print(f\"Validation Time: {datetime.now().isoformat()}\")\n\n        # Check system status\n        try:\n            resp = self.session.get(f\"{self.guardian_url}\u002Fapi\u002Fv1\u002Fsystem\u002Fstatus\")\n            if resp.status_code == 200:\n                status = resp.json()\n                print(f\"\\n--- SYSTEM STATUS ---\")\n                print(f\"  Version: {status.get('version', 'N\u002FA')}\")\n                print(f\"  Uptime: {status.get('uptime', 'N\u002FA')}\")\n                print(f\"  Packets Processed: {status.get('packets_processed', 'N\u002FA')}\")\n                print(f\"  Threat Intelligence: {status.get('threat_intelligence_version', 'N\u002FA')}\")\n        except requests.RequestException as e:\n            print(f\"  [!] System status unavailable: {e}\")\n\n        # Asset discovery summary\n        nodes = self.get_nodes()\n        print(f\"\\n--- ASSET DISCOVERY ---\")\n        print(f\"  Total Nodes Discovered: {len(nodes)}\")\n\n        type_counts = defaultdict(int)\n        vendor_counts = defaultdict(int)\n        protocol_set = set()\n        for node in nodes:\n            type_counts[node.get(\"type\", \"unknown\")] += 1\n            vendor_counts[node.get(\"vendor\", \"Unknown\")] += 1\n            for proto in node.get(\"protocols\", []):\n                protocol_set.add(proto)\n\n        print(f\"\\n  By Type:\")\n        for ntype, count in sorted(type_counts.items(), key=lambda x: -x[1]):\n            print(f\"    {ntype}: {count}\")\n\n        print(f\"\\n  By Vendor:\")\n        for vendor, count in sorted(vendor_counts.items(), key=lambda x: -x[1])[:10]:\n            print(f\"    {vendor}: {count}\")\n\n        print(f\"\\n  Protocols Observed: {', '.join(sorted(protocol_set))}\")\n\n        # Alert summary\n        alerts = self.get_alerts(severity=\"high\")\n        print(f\"\\n--- ALERT SUMMARY ---\")\n        print(f\"  High\u002FCritical Alerts: {len(alerts)}\")\n\n        alert_types = defaultdict(int)\n        for alert in alerts:\n            alert_types[alert.get(\"type_id\", \"unknown\")] += 1\n\n        for atype, count in sorted(alert_types.items(), key=lambda x: -x[1])[:10]:\n            print(f\"    {atype}: {count}\")\n\n        # Vulnerability summary\n        vulns = self.get_vulnerabilities()\n        print(f\"\\n--- VULNERABILITY SUMMARY ---\")\n        print(f\"  Total Vulnerabilities: {len(vulns)}\")\n\n        sev_counts = defaultdict(int)\n        for vuln in vulns:\n            sev_counts[vuln.get(\"severity\", \"unknown\")] += 1\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            if sev in sev_counts:\n                print(f\"    {sev.capitalize()}: {sev_counts[sev]}\")\n\n    def analyze_communication_patterns(self):\n        \"\"\"Analyze OT communication patterns for anomalies.\"\"\"\n        links = self.get_links()\n        nodes = {n.get(\"id\"): n for n in self.get_nodes()}\n\n        print(f\"\\n--- COMMUNICATION ANALYSIS ---\")\n        print(f\"  Total Communication Links: {len(links)}\")\n\n        # Identify cross-zone communications\n        cross_zone = []\n        for link in links:\n            src_node = nodes.get(link.get(\"source_id\"), {})\n            dst_node = nodes.get(link.get(\"destination_id\"), {})\n            src_zone = src_node.get(\"zone\", \"unknown\")\n            dst_zone = dst_node.get(\"zone\", \"unknown\")\n\n            if src_zone != dst_zone and src_zone != \"unknown\" and dst_zone != \"unknown\":\n                cross_zone.append({\n                    \"source\": src_node.get(\"label\", \"Unknown\"),\n                    \"source_zone\": src_zone,\n                    \"destination\": dst_node.get(\"label\", \"Unknown\"),\n                    \"dest_zone\": dst_zone,\n                    \"protocols\": link.get(\"protocols\", []),\n                })\n\n        if cross_zone:\n            print(f\"\\n  Cross-Zone Communications: {len(cross_zone)}\")\n            for comm in cross_zone[:10]:\n                print(f\"    {comm['source']} ({comm['source_zone']}) -> \"\n                      f\"{comm['destination']} ({comm['dest_zone']}) \"\n                      f\"via {', '.join(comm['protocols'])}\")\n\n\nif __name__ == \"__main__\":\n    manager = NozomiGuardianManager(\n        guardian_url=\"https:\u002F\u002Fnozomi-guardian.plant.local\",\n        api_token=\"your-api-token\",\n    )\n\n    manager.validate_deployment()\n    manager.analyze_communication_patterns()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Guardian | Nozomi Networks passive sensor that monitors OT network traffic via SPAN\u002FTAP without generating additional traffic |\n| Vantage | Nozomi cloud-based central management platform for aggregating data across multiple Guardian sensors |\n| Behavioral Anomaly Detection (BAD) | Nozomi's AI-driven approach to detecting deviations from learned normal OT network behavior |\n| Smart Polling | Nozomi's active query feature using native protocols to safely extract additional device details |\n| Asset Intelligence | Nozomi's automatic identification and classification of OT\u002FIoT assets from network traffic |\n| Threat Intelligence Feed | Nozomi Labs-maintained feed of OT-specific threat indicators, updated based on global honeypot data |\n\n## Output Format\n\n```\nNOZOMI GUARDIAN OT MONITORING REPORT\n=======================================\nSite: [site name]\nDate: YYYY-MM-DD\n\nASSET VISIBILITY:\n  Total Assets: [count]\n  PLCs: [count] | HMIs: [count] | Switches: [count]\n  Protocols: [list]\n  Vendors: [top 5]\n\nTHREAT DETECTION:\n  Critical Alerts: [count]\n  High Alerts: [count]\n  Top Alert Categories: [list]\n\nVULNERABILITIES:\n  Critical: [count]\n  High: [count]\n\nNETWORK ANALYSIS:\n  Communication Links: [count]\n  Cross-Zone Flows: [count]\n```\n",{"name":5,"tags":48,"author":52,"domain":32,"license":14,"version":53,"subdomain":54,"description":55},[39,38,29,49,40,50,51,35],"guardian","asset-visibility","anomaly-detection","mahipal","1.0","ot-ics-security","Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across industrial control systems without disrupting operations, leveraging behavioral anomaly detection and protocol-aware monitoring.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add micsapp\u002Fmicstec-skills --skill implementing-ot-network-traffic-analysis-with-nozomi",{"tool":69,"command":70},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill implementing-ot-network-traffic-analysis-with-nozomi",{"tool":72,"command":73},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill implementing-ot-network-traffic-analysis-with-nozomi","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi\u002FSKILL.md",true,[77,82,88],{"path":78,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi\u002FLICENSE",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fapi-reference.md","REFERENCE","参考文档",2319,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi\u002Freferences\u002Fapi-reference.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fagent.py","SCRIPT","脚本",3802,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fimplementing-ot-network-traffic-analysis-with-nozomi\u002Fscripts\u002Fagent.py",[95,129,156,177,197,222],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":110,"publishedAt":43},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[102,105],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[111,112,113,114,115,116,117,118,24,119,120,121,122,123,124,125,126,127,128,31],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":141,"publishedAt":43},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[135,136,137,140],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":138,"categoryName":139,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},[142,143,144,145,112,146,147,148,149,150,151,152,119,120,126,153,154,127,155,23],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":43},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[162],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},[164,165,166,167,112,115,119,120,168,169,170,171,172,173,174,127,175,176,23,31],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":185,"publishedAt":43},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[183,184],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},[186,167,187,119,171,188,112,142,189,190,191,192,120,193,127,194,195,196,128,31],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":43},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[204,205,206,144,207,208,209,210,119,211,212,213,214,215,216,217,218,219,220,221],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":43},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[224,229,230,231,232,233,234,169,235,236],"npm","js","calculate","node","math","user","compute","errors"]