[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DREAPJJG74ZPJCTF0BQ3H":3,"skill-same:01M71DREAPJJG74ZPJCTF0BQ3H":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":6,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M71DREAPJJG74ZPJCTF0BQ3H","ics-asset-management-claroty-discover-monitor",null,"Perform comprehensive ICS\u002FOT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fasset-management\u002Fclaroty\u002Fdiscover\u002Fmonitor\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"management","ics asset management claroty discover monitor","asset","discover","claroty","ics","monitor","asset-discovery","xdome","network-visibility","Bash","model","cybersecurity","aml","cm","map","across","de","monitoring","ecosystem","2026-11-10 10:12:30",false,"---\nname: ics-asset-management-claroty-discover-monitor\ndescription: Perform comprehensive ICS\u002FOT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- asset-discovery\n- claroty\n- xdome\n- scada\n- network-visibility\n- iec62443\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T0855\n- T1082\ncapec: []\n---\n\n# Performing ICS Asset Discovery with Claroty\n\n## When to Use\n\n- When gaining initial visibility into an OT environment with unknown or poorly documented assets\n- When preparing for an IEC 62443 risk assessment requiring a complete asset inventory\n- When onboarding Claroty xDome into a brownfield industrial environment\n- When validating existing asset inventory against actual network communications\n- When identifying shadow OT devices or unauthorized connections in the control network\n\n**Do not use** for IT-only asset discovery (use tools like Nessus or Qualys), for active scanning of sensitive PLC networks without vendor approval, or for environments where Claroty is not the deployed platform (see implementing-ot-network-traffic-analysis-with-nozomi).\n\n## Prerequisites\n\n- Claroty xDome SaaS subscription or on-premises deployment\n- Network TAP or SPAN port configured at OT network boundaries (Levels 1-3 of Purdue Model)\n- Claroty Edge collector deployed for safe active querying of hard-to-reach network segments\n- Integration credentials for CMDB tools (ServiceNow, BMC) if used\n- Network architecture diagram showing VLANs, switches, and firewall zones\n\n## Workflow\n\n### Step 1: Configure Passive Network Monitoring\n\nDeploy Claroty sensors on SPAN ports to passively observe all OT network traffic without impacting operations.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Claroty xDome Asset Discovery Configuration and Reporting Tool.\n\nAutomates the configuration of passive monitoring sensors and generates\nasset inventory reports from Claroty xDome API.\n\"\"\"\n\nimport json\nimport sys\nimport csv\nfrom datetime import datetime\nfrom typing import Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass ClarotyAssetDiscovery:\n    \"\"\"Interface with Claroty xDome API for ICS asset discovery.\"\"\"\n\n    def __init__(self, base_url: str, api_token: str, verify_ssl: bool = True):\n        self.base_url = base_url.rstrip(\"\u002F\")\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Authorization\": f\"Bearer {api_token}\",\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\",\n        })\n        self.session.verify = verify_ssl\n\n    def get_sites(self):\n        \"\"\"Retrieve all monitored sites.\"\"\"\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fsites\")\n        resp.raise_for_status()\n        return resp.json().get(\"sites\", [])\n\n    def get_assets(self, site_id: Optional[str] = None, asset_type: Optional[str] = None):\n        \"\"\"Retrieve discovered assets with optional filtering.\n\n        asset_type: PLC, RTU, HMI, DCS, Engineering_Workstation,\n                    Historian, Network_Device, IO_Module, Safety_Controller\n        \"\"\"\n        params = {}\n        if site_id:\n            params[\"site_id\"] = site_id\n        if asset_type:\n            params[\"type\"] = asset_type\n\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fassets\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"assets\", [])\n\n    def get_asset_detail(self, asset_id: str):\n        \"\"\"Retrieve detailed asset information including firmware, modules, and CVEs.\"\"\"\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fassets\u002F{asset_id}\")\n        resp.raise_for_status()\n        return resp.json()\n\n    def get_communication_map(self, site_id: str):\n        \"\"\"Retrieve communication relationships between assets.\"\"\"\n        resp = self.session.get(\n            f\"{self.base_url}\u002Fapi\u002Fv1\u002Fsites\u002F{site_id}\u002Fcommunications\"\n        )\n        resp.raise_for_status()\n        return resp.json().get(\"communications\", [])\n\n    def get_vulnerabilities(self, site_id: Optional[str] = None, severity: str = \"critical\"):\n        \"\"\"Retrieve vulnerabilities for discovered assets.\"\"\"\n        params = {\"min_severity\": severity}\n        if site_id:\n            params[\"site_id\"] = site_id\n\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fvulnerabilities\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"vulnerabilities\", [])\n\n    def export_asset_inventory(self, output_file: str, site_id: Optional[str] = None):\n        \"\"\"Export full asset inventory to CSV for compliance reporting.\"\"\"\n        assets = self.get_assets(site_id=site_id)\n        if not assets:\n            print(\"[!] No assets found\")\n            return\n\n        fieldnames = [\n            \"asset_id\", \"name\", \"type\", \"vendor\", \"model\", \"firmware_version\",\n            \"ip_address\", \"mac_address\", \"serial_number\", \"purdue_level\",\n            \"zone\", \"protocol\", \"first_seen\", \"last_seen\", \"risk_score\",\n            \"cve_count\", \"site_name\",\n        ]\n\n        with open(output_file, \"w\", newline=\"\") as f:\n            writer = csv.DictWriter(f, fieldnames=fieldnames)\n            writer.writeheader()\n            for asset in assets:\n                writer.writerow({\n                    \"asset_id\": asset.get(\"id\", \"\"),\n                    \"name\": asset.get(\"name\", \"Unknown\"),\n                    \"type\": asset.get(\"type\", \"\"),\n                    \"vendor\": asset.get(\"vendor\", \"\"),\n                    \"model\": asset.get(\"model\", \"\"),\n                    \"firmware_version\": asset.get(\"firmware_version\", \"\"),\n                    \"ip_address\": asset.get(\"ip_address\", \"\"),\n                    \"mac_address\": asset.get(\"mac_address\", \"\"),\n                    \"serial_number\": asset.get(\"serial_number\", \"\"),\n                    \"purdue_level\": asset.get(\"purdue_level\", \"\"),\n                    \"zone\": asset.get(\"zone\", \"\"),\n                    \"protocol\": \", \".join(asset.get(\"protocols\", [])),\n                    \"first_seen\": asset.get(\"first_seen\", \"\"),\n                    \"last_seen\": asset.get(\"last_seen\", \"\"),\n                    \"risk_score\": asset.get(\"risk_score\", 0),\n                    \"cve_count\": asset.get(\"cve_count\", 0),\n                    \"site_name\": asset.get(\"site_name\", \"\"),\n                })\n\n        print(f\"[+] Exported {len(assets)} assets to {output_file}\")\n\n    def generate_purdue_level_report(self, site_id: str):\n        \"\"\"Generate asset distribution report by Purdue Model level.\"\"\"\n        assets = self.get_assets(site_id=site_id)\n        levels = {0: [], 1: [], 2: [], 3: [], 3.5: [], 4: [], 5: []}\n\n        for asset in assets:\n            level = asset.get(\"purdue_level\", -1)\n            if level in levels:\n                levels[level].append(asset)\n\n        print(f\"\\n{'='*65}\")\n        print(\"PURDUE MODEL ASSET DISTRIBUTION REPORT\")\n        print(f\"{'='*65}\")\n        print(f\"Site: {site_id}\")\n        print(f\"Total Assets Discovered: {len(assets)}\")\n        print(f\"Report Generated: {datetime.now().isoformat()}\")\n        print(f\"{'-'*65}\")\n\n        level_names = {\n            0: \"Level 0 - Physical Process (Sensors\u002FActuators)\",\n            1: \"Level 1 - Basic Control (PLCs\u002FRTUs)\",\n            2: \"Level 2 - Supervisory Control (HMI\u002FSCADA)\",\n            3: \"Level 3 - Site Operations (Historian\u002FMES)\",\n            3.5: \"Level 3.5 - IT\u002FOT DMZ\",\n            4: \"Level 4 - Enterprise IT\",\n            5: \"Level 5 - Enterprise Network\u002FInternet\",\n        }\n\n        for level, name in level_names.items():\n            device_list = levels.get(level, [])\n            print(f\"\\n  {name}\")\n            print(f\"    Count: {len(device_list)}\")\n            if device_list:\n                vendors = set(a.get(\"vendor\", \"Unknown\") for a in device_list)\n                types = set(a.get(\"type\", \"Unknown\") for a in device_list)\n                print(f\"    Vendors: {', '.join(vendors)}\")\n                print(f\"    Types: {', '.join(types)}\")\n                high_risk = [a for a in device_list if a.get(\"risk_score\", 0) >= 7]\n                if high_risk:\n                    print(f\"    High-Risk Assets: {len(high_risk)}\")\n                    for a in high_risk[:5]:\n                        print(f\"      - {a['name']} (Risk: {a.get('risk_score')})\")\n\n\nif __name__ == \"__main__\":\n    discovery = ClarotyAssetDiscovery(\n        base_url=\"https:\u002F\u002Fyour-claroty-instance.claroty.cloud\",\n        api_token=\"your-api-token-here\",\n        verify_ssl=True,\n    )\n\n    print(\"[*] Fetching sites...\")\n    sites = discovery.get_sites()\n    for site in sites:\n        print(f\"  Site: {site['name']} (ID: {site['id']})\")\n\n    if sites:\n        site_id = sites[0][\"id\"]\n        print(f\"\\n[*] Generating Purdue level report for {sites[0]['name']}...\")\n        discovery.generate_purdue_level_report(site_id)\n\n        print(f\"\\n[*] Exporting asset inventory...\")\n        discovery.export_asset_inventory(\n            f\"asset_inventory_{datetime.now().strftime('%Y%m%d')}.csv\",\n            site_id=site_id,\n        )\n\n        print(f\"\\n[*] Checking critical vulnerabilities...\")\n        vulns = discovery.get_vulnerabilities(site_id=site_id, severity=\"critical\")\n        print(f\"  Critical vulnerabilities: {len(vulns)}\")\n        for v in vulns[:10]:\n            print(f\"    - {v.get('cve_id')}: {v.get('description', '')[:80]}\")\n```\n\n### Step 2: Configure Active Discovery with Claroty Edge\n\nClaroty Edge performs safe, targeted queries of OT devices using native industrial protocols (not IT scanning) to extract detailed asset information from devices that passive monitoring alone cannot fully identify.\n\n```yaml\n# Claroty Edge Active Discovery Configuration\n# Safe active queries using native industrial protocols\n\nedge_configuration:\n  deployment_mode: \"on-premises\"\n  collection_schedule:\n    frequency: \"weekly\"\n    maintenance_window: \"Sunday 02:00-06:00\"\n    max_concurrent_queries: 5\n\n  protocol_queries:\n    siemens_s7:\n      enabled: true\n      target_subnets: [\"10.10.1.0\u002F24\", \"10.10.2.0\u002F24\"]\n      ports: [102]\n      query_type: \"SZL_read\"\n      information_collected:\n        - \"Module identification\"\n        - \"Firmware version\"\n        - \"Hardware configuration\"\n        - \"Protection level\"\n\n    rockwell_cip:\n      enabled: true\n      target_subnets: [\"10.10.3.0\u002F24\"]\n      ports: [44818]\n      query_type: \"CIP_identity\"\n      information_collected:\n        - \"Product name and revision\"\n        - \"Serial number\"\n        - \"Device type\"\n        - \"Vendor ID\"\n\n    modbus:\n      enabled: true\n      target_subnets: [\"10.10.4.0\u002F24\"]\n      ports: [502]\n      query_type: \"read_device_identification\"\n      function_code: 43\n      information_collected:\n        - \"Vendor name\"\n        - \"Product code\"\n        - \"Firmware revision\"\n\n    bacnet:\n      enabled: true\n      target_subnets: [\"10.10.5.0\u002F24\"]\n      ports: [47808]\n      query_type: \"who_is\"\n      information_collected:\n        - \"Device name\"\n        - \"Vendor identifier\"\n        - \"Model name\"\n        - \"Application software version\"\n\n  safety_controls:\n    excluded_subnets: [\"10.10.100.0\u002F24\"]  # SIS network - never active scan\n    rate_limiting: true\n    max_packets_per_second: 10\n    timeout_seconds: 5\n    retry_count: 1\n    abort_on_device_error: true\n```\n\n### Step 3: Validate and Enrich Asset Data\n\nCross-reference discovered assets against known inventories and enrich with vulnerability data.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Asset Validation and Enrichment Tool.\n\nCross-references Claroty discovery results against existing CMDB\nand enriches with NVD vulnerability data.\n\"\"\"\n\nimport json\nimport csv\nimport sys\nfrom datetime import datetime\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass AssetValidator:\n    \"\"\"Validates and enriches OT asset inventory.\"\"\"\n\n    def __init__(self, inventory_file: str):\n        self.discovered_assets = []\n        self.load_inventory(inventory_file)\n        self.discrepancies = []\n\n    def load_inventory(self, filepath: str):\n        \"\"\"Load Claroty-discovered asset inventory.\"\"\"\n        with open(filepath, \"r\") as f:\n            reader = csv.DictReader(f)\n            self.discovered_assets = list(reader)\n        print(f\"[*] Loaded {len(self.discovered_assets)} discovered assets\")\n\n    def compare_with_cmdb(self, cmdb_file: str):\n        \"\"\"Compare discovered assets against CMDB records.\"\"\"\n        with open(cmdb_file, \"r\") as f:\n            cmdb_assets = {row[\"ip_address\"]: row for row in csv.DictReader(f)}\n\n        discovered_ips = {a[\"ip_address\"] for a in self.discovered_assets if a[\"ip_address\"]}\n        cmdb_ips = set(cmdb_assets.keys())\n\n        shadow_devices = discovered_ips - cmdb_ips\n        missing_devices = cmdb_ips - discovered_ips\n\n        print(f\"\\n{'='*60}\")\n        print(\"ASSET INVENTORY VALIDATION REPORT\")\n        print(f\"{'='*60}\")\n        print(f\"Discovered assets: {len(discovered_ips)}\")\n        print(f\"CMDB records: {len(cmdb_ips)}\")\n        print(f\"Shadow OT devices (not in CMDB): {len(shadow_devices)}\")\n        print(f\"Missing devices (in CMDB, not seen): {len(missing_devices)}\")\n\n        if shadow_devices:\n            print(f\"\\n  SHADOW DEVICES (Unauthorized\u002FUndocumented):\")\n            for ip in sorted(shadow_devices):\n                asset = next((a for a in self.discovered_assets if a[\"ip_address\"] == ip), {})\n                print(f\"    - {ip} | {asset.get('vendor', 'Unknown')} {asset.get('model', '')} | Type: {asset.get('type', 'Unknown')}\")\n                self.discrepancies.append({\n                    \"type\": \"SHADOW_DEVICE\",\n                    \"severity\": \"HIGH\",\n                    \"ip\": ip,\n                    \"detail\": f\"Undocumented {asset.get('type', 'device')} from {asset.get('vendor', 'unknown vendor')}\",\n                })\n\n        if missing_devices:\n            print(f\"\\n  MISSING DEVICES (Expected but not seen):\")\n            for ip in sorted(missing_devices):\n                cmdb = cmdb_assets[ip]\n                print(f\"    - {ip} | {cmdb.get('name', 'Unknown')} | Last CMDB update: {cmdb.get('last_updated', 'N\u002FA')}\")\n                self.discrepancies.append({\n                    \"type\": \"MISSING_DEVICE\",\n                    \"severity\": \"MEDIUM\",\n                    \"ip\": ip,\n                    \"detail\": f\"CMDB asset {cmdb.get('name', ip)} not seen on network\",\n                })\n\n    def check_firmware_vulnerabilities(self, asset):\n        \"\"\"Check NVD for known vulnerabilities matching asset firmware.\"\"\"\n        vendor = asset.get(\"vendor\", \"\").lower()\n        model = asset.get(\"model\", \"\").lower()\n        firmware = asset.get(\"firmware_version\", \"\")\n\n        if not vendor or not model:\n            return []\n\n        search_term = f\"{vendor} {model}\"\n        try:\n            resp = requests.get(\n                \"https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0\",\n                params={\"keywordSearch\": search_term, \"resultsPerPage\": 10},\n                timeout=15,\n            )\n            if resp.status_code == 200:\n                data = resp.json()\n                return data.get(\"vulnerabilities\", [])\n        except requests.RequestException:\n            pass\n        return []\n\n    def generate_risk_summary(self):\n        \"\"\"Generate risk-prioritized summary of findings.\"\"\"\n        print(f\"\\n{'='*60}\")\n        print(\"RISK SUMMARY\")\n        print(f\"{'='*60}\")\n\n        high_risk = [a for a in self.discovered_assets if float(a.get(\"risk_score\", 0)) >= 7]\n        end_of_life = [a for a in self.discovered_assets if a.get(\"firmware_version\", \"\").startswith(\"v1.\")]\n        no_encryption = [a for a in self.discovered_assets if \"modbus\" in a.get(\"protocol\", \"\").lower()]\n\n        print(f\"  High-risk assets (score >= 7): {len(high_risk)}\")\n        print(f\"  Potentially end-of-life firmware: {len(end_of_life)}\")\n        print(f\"  Assets using unencrypted protocols: {len(no_encryption)}\")\n        print(f\"  Inventory discrepancies: {len(self.discrepancies)}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(\"Usage: python validate_assets.py \u003Cclaroty_export.csv> [cmdb_export.csv]\")\n        sys.exit(1)\n\n    validator = AssetValidator(sys.argv[1])\n    if len(sys.argv) >= 3:\n        validator.compare_with_cmdb(sys.argv[2])\n    validator.generate_risk_summary()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Passive Monitoring | Observing mirrored network traffic via SPAN\u002FTAP without injecting packets, safe for all OT devices |\n| Active Querying | Sending native protocol requests to extract detailed device information; requires careful scheduling |\n| Claroty Edge | Claroty's safe active discovery collector that uses native industrial protocols rather than IT scanning |\n| Purdue Level | Hierarchical classification of industrial network assets from Level 0 (physical process) to Level 5 (enterprise) |\n| Shadow OT Device | Asset connected to the OT network that is not documented in the asset management system |\n| xDome | Claroty's SaaS-based cyber-physical systems protection platform providing visibility, risk management, and threat detection |\n\n## Common Scenarios\n\n### Scenario: Brownfield Factory Asset Discovery\n\n**Context**: A manufacturing plant with 20 years of equipment additions needs a complete OT asset inventory for an IEC 62443 risk assessment. No accurate asset records exist.\n\n**Approach**:\n1. Deploy Claroty sensors on SPAN ports at each major network segment (control, supervisory, DMZ)\n2. Allow passive monitoring for 2-4 weeks to capture all regular communication patterns\n3. Schedule Claroty Edge active queries during a planned maintenance window\n4. Export discovered inventory and categorize assets by Purdue level, vendor, and criticality\n5. Cross-reference against any existing documentation (P&ID diagrams, network drawings)\n6. Identify shadow devices and initiate a review process with plant operations\n7. Feed validated inventory into IEC 62443 zone and conduit risk assessment\n\n**Pitfalls**: Do not rush active discovery before passive monitoring has captured baseline traffic patterns. Never use IT vulnerability scanners (Nessus active scans) directly against PLCs or RTUs -- this can crash legacy controllers. Always exclude Safety Instrumented Systems (SIS) from active queries.\n\n## Output Format\n\n```\nICS ASSET DISCOVERY REPORT\n============================\nDate: YYYY-MM-DD\nPlatform: Claroty xDome\nSite: [Site Name]\n\nDISCOVERY SUMMARY:\n  Total Assets Discovered: [count]\n  New Assets (not in CMDB): [count]\n  High-Risk Assets: [count]\n\nPURDUE LEVEL DISTRIBUTION:\n  Level 0 (Process): [count] assets\n  Level 1 (Control): [count] assets\n  Level 2 (Supervisory): [count] assets\n  Level 3 (Operations): [count] assets\n  Level 3.5 (DMZ): [count] assets\n  Level 4-5 (Enterprise): [count] assets\n\nTOP VENDORS:\n  1. [Vendor] - [count] devices\n  2. [Vendor] - [count] devices\n\nCRITICAL FINDINGS:\n  - [Shadow device description]\n  - [End-of-life firmware finding]\n  - [Unencrypted protocol concern]\n```\n","# Performing ICS Asset Discovery with Claroty\n\n## When to Use\n\n- When gaining initial visibility into an OT environment with unknown or poorly documented assets\n- When preparing for an IEC 62443 risk assessment requiring a complete asset inventory\n- When onboarding Claroty xDome into a brownfield industrial environment\n- When validating existing asset inventory against actual network communications\n- When identifying shadow OT devices or unauthorized connections in the control network\n\n**Do not use** for IT-only asset discovery (use tools like Nessus or Qualys), for active scanning of sensitive PLC networks without vendor approval, or for environments where Claroty is not the deployed platform (see implementing-ot-network-traffic-analysis-with-nozomi).\n\n## Prerequisites\n\n- Claroty xDome SaaS subscription or on-premises deployment\n- Network TAP or SPAN port configured at OT network boundaries (Levels 1-3 of Purdue Model)\n- Claroty Edge collector deployed for safe active querying of hard-to-reach network segments\n- Integration credentials for CMDB tools (ServiceNow, BMC) if used\n- Network architecture diagram showing VLANs, switches, and firewall zones\n\n## Workflow\n\n### Step 1: Configure Passive Network Monitoring\n\nDeploy Claroty sensors on SPAN ports to passively observe all OT network traffic without impacting operations.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Claroty xDome Asset Discovery Configuration and Reporting Tool.\n\nAutomates the configuration of passive monitoring sensors and generates\nasset inventory reports from Claroty xDome API.\n\"\"\"\n\nimport json\nimport sys\nimport csv\nfrom datetime import datetime\nfrom typing import Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass ClarotyAssetDiscovery:\n    \"\"\"Interface with Claroty xDome API for ICS asset discovery.\"\"\"\n\n    def __init__(self, base_url: str, api_token: str, verify_ssl: bool = True):\n        self.base_url = base_url.rstrip(\"\u002F\")\n        self.session = requests.Session()\n        self.session.headers.update({\n            \"Authorization\": f\"Bearer {api_token}\",\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\",\n        })\n        self.session.verify = verify_ssl\n\n    def get_sites(self):\n        \"\"\"Retrieve all monitored sites.\"\"\"\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fsites\")\n        resp.raise_for_status()\n        return resp.json().get(\"sites\", [])\n\n    def get_assets(self, site_id: Optional[str] = None, asset_type: Optional[str] = None):\n        \"\"\"Retrieve discovered assets with optional filtering.\n\n        asset_type: PLC, RTU, HMI, DCS, Engineering_Workstation,\n                    Historian, Network_Device, IO_Module, Safety_Controller\n        \"\"\"\n        params = {}\n        if site_id:\n            params[\"site_id\"] = site_id\n        if asset_type:\n            params[\"type\"] = asset_type\n\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fassets\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"assets\", [])\n\n    def get_asset_detail(self, asset_id: str):\n        \"\"\"Retrieve detailed asset information including firmware, modules, and CVEs.\"\"\"\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fassets\u002F{asset_id}\")\n        resp.raise_for_status()\n        return resp.json()\n\n    def get_communication_map(self, site_id: str):\n        \"\"\"Retrieve communication relationships between assets.\"\"\"\n        resp = self.session.get(\n            f\"{self.base_url}\u002Fapi\u002Fv1\u002Fsites\u002F{site_id}\u002Fcommunications\"\n        )\n        resp.raise_for_status()\n        return resp.json().get(\"communications\", [])\n\n    def get_vulnerabilities(self, site_id: Optional[str] = None, severity: str = \"critical\"):\n        \"\"\"Retrieve vulnerabilities for discovered assets.\"\"\"\n        params = {\"min_severity\": severity}\n        if site_id:\n            params[\"site_id\"] = site_id\n\n        resp = self.session.get(f\"{self.base_url}\u002Fapi\u002Fv1\u002Fvulnerabilities\", params=params)\n        resp.raise_for_status()\n        return resp.json().get(\"vulnerabilities\", [])\n\n    def export_asset_inventory(self, output_file: str, site_id: Optional[str] = None):\n        \"\"\"Export full asset inventory to CSV for compliance reporting.\"\"\"\n        assets = self.get_assets(site_id=site_id)\n        if not assets:\n            print(\"[!] No assets found\")\n            return\n\n        fieldnames = [\n            \"asset_id\", \"name\", \"type\", \"vendor\", \"model\", \"firmware_version\",\n            \"ip_address\", \"mac_address\", \"serial_number\", \"purdue_level\",\n            \"zone\", \"protocol\", \"first_seen\", \"last_seen\", \"risk_score\",\n            \"cve_count\", \"site_name\",\n        ]\n\n        with open(output_file, \"w\", newline=\"\") as f:\n            writer = csv.DictWriter(f, fieldnames=fieldnames)\n            writer.writeheader()\n            for asset in assets:\n                writer.writerow({\n                    \"asset_id\": asset.get(\"id\", \"\"),\n                    \"name\": asset.get(\"name\", \"Unknown\"),\n                    \"type\": asset.get(\"type\", \"\"),\n                    \"vendor\": asset.get(\"vendor\", \"\"),\n                    \"model\": asset.get(\"model\", \"\"),\n                    \"firmware_version\": asset.get(\"firmware_version\", \"\"),\n                    \"ip_address\": asset.get(\"ip_address\", \"\"),\n                    \"mac_address\": asset.get(\"mac_address\", \"\"),\n                    \"serial_number\": asset.get(\"serial_number\", \"\"),\n                    \"purdue_level\": asset.get(\"purdue_level\", \"\"),\n                    \"zone\": asset.get(\"zone\", \"\"),\n                    \"protocol\": \", \".join(asset.get(\"protocols\", [])),\n                    \"first_seen\": asset.get(\"first_seen\", \"\"),\n                    \"last_seen\": asset.get(\"last_seen\", \"\"),\n                    \"risk_score\": asset.get(\"risk_score\", 0),\n                    \"cve_count\": asset.get(\"cve_count\", 0),\n                    \"site_name\": asset.get(\"site_name\", \"\"),\n                })\n\n        print(f\"[+] Exported {len(assets)} assets to {output_file}\")\n\n    def generate_purdue_level_report(self, site_id: str):\n        \"\"\"Generate asset distribution report by Purdue Model level.\"\"\"\n        assets = self.get_assets(site_id=site_id)\n        levels = {0: [], 1: [], 2: [], 3: [], 3.5: [], 4: [], 5: []}\n\n        for asset in assets:\n            level = asset.get(\"purdue_level\", -1)\n            if level in levels:\n                levels[level].append(asset)\n\n        print(f\"\\n{'='*65}\")\n        print(\"PURDUE MODEL ASSET DISTRIBUTION REPORT\")\n        print(f\"{'='*65}\")\n        print(f\"Site: {site_id}\")\n        print(f\"Total Assets Discovered: {len(assets)}\")\n        print(f\"Report Generated: {datetime.now().isoformat()}\")\n        print(f\"{'-'*65}\")\n\n        level_names = {\n            0: \"Level 0 - Physical Process (Sensors\u002FActuators)\",\n            1: \"Level 1 - Basic Control (PLCs\u002FRTUs)\",\n            2: \"Level 2 - Supervisory Control (HMI\u002FSCADA)\",\n            3: \"Level 3 - Site Operations (Historian\u002FMES)\",\n            3.5: \"Level 3.5 - IT\u002FOT DMZ\",\n            4: \"Level 4 - Enterprise IT\",\n            5: \"Level 5 - Enterprise Network\u002FInternet\",\n        }\n\n        for level, name in level_names.items():\n            device_list = levels.get(level, [])\n            print(f\"\\n  {name}\")\n            print(f\"    Count: {len(device_list)}\")\n            if device_list:\n                vendors = set(a.get(\"vendor\", \"Unknown\") for a in device_list)\n                types = set(a.get(\"type\", \"Unknown\") for a in device_list)\n                print(f\"    Vendors: {', '.join(vendors)}\")\n                print(f\"    Types: {', '.join(types)}\")\n                high_risk = [a for a in device_list if a.get(\"risk_score\", 0) >= 7]\n                if high_risk:\n                    print(f\"    High-Risk Assets: {len(high_risk)}\")\n                    for a in high_risk[:5]:\n                        print(f\"      - {a['name']} (Risk: {a.get('risk_score')})\")\n\n\nif __name__ == \"__main__\":\n    discovery = ClarotyAssetDiscovery(\n        base_url=\"https:\u002F\u002Fyour-claroty-instance.claroty.cloud\",\n        api_token=\"your-api-token-here\",\n        verify_ssl=True,\n    )\n\n    print(\"[*] Fetching sites...\")\n    sites = discovery.get_sites()\n    for site in sites:\n        print(f\"  Site: {site['name']} (ID: {site['id']})\")\n\n    if sites:\n        site_id = sites[0][\"id\"]\n        print(f\"\\n[*] Generating Purdue level report for {sites[0]['name']}...\")\n        discovery.generate_purdue_level_report(site_id)\n\n        print(f\"\\n[*] Exporting asset inventory...\")\n        discovery.export_asset_inventory(\n            f\"asset_inventory_{datetime.now().strftime('%Y%m%d')}.csv\",\n            site_id=site_id,\n        )\n\n        print(f\"\\n[*] Checking critical vulnerabilities...\")\n        vulns = discovery.get_vulnerabilities(site_id=site_id, severity=\"critical\")\n        print(f\"  Critical vulnerabilities: {len(vulns)}\")\n        for v in vulns[:10]:\n            print(f\"    - {v.get('cve_id')}: {v.get('description', '')[:80]}\")\n```\n\n### Step 2: Configure Active Discovery with Claroty Edge\n\nClaroty Edge performs safe, targeted queries of OT devices using native industrial protocols (not IT scanning) to extract detailed asset information from devices that passive monitoring alone cannot fully identify.\n\n```yaml\n# Claroty Edge Active Discovery Configuration\n# Safe active queries using native industrial protocols\n\nedge_configuration:\n  deployment_mode: \"on-premises\"\n  collection_schedule:\n    frequency: \"weekly\"\n    maintenance_window: \"Sunday 02:00-06:00\"\n    max_concurrent_queries: 5\n\n  protocol_queries:\n    siemens_s7:\n      enabled: true\n      target_subnets: [\"10.10.1.0\u002F24\", \"10.10.2.0\u002F24\"]\n      ports: [102]\n      query_type: \"SZL_read\"\n      information_collected:\n        - \"Module identification\"\n        - \"Firmware version\"\n        - \"Hardware configuration\"\n        - \"Protection level\"\n\n    rockwell_cip:\n      enabled: true\n      target_subnets: [\"10.10.3.0\u002F24\"]\n      ports: [44818]\n      query_type: \"CIP_identity\"\n      information_collected:\n        - \"Product name and revision\"\n        - \"Serial number\"\n        - \"Device type\"\n        - \"Vendor ID\"\n\n    modbus:\n      enabled: true\n      target_subnets: [\"10.10.4.0\u002F24\"]\n      ports: [502]\n      query_type: \"read_device_identification\"\n      function_code: 43\n      information_collected:\n        - \"Vendor name\"\n        - \"Product code\"\n        - \"Firmware revision\"\n\n    bacnet:\n      enabled: true\n      target_subnets: [\"10.10.5.0\u002F24\"]\n      ports: [47808]\n      query_type: \"who_is\"\n      information_collected:\n        - \"Device name\"\n        - \"Vendor identifier\"\n        - \"Model name\"\n        - \"Application software version\"\n\n  safety_controls:\n    excluded_subnets: [\"10.10.100.0\u002F24\"]  # SIS network - never active scan\n    rate_limiting: true\n    max_packets_per_second: 10\n    timeout_seconds: 5\n    retry_count: 1\n    abort_on_device_error: true\n```\n\n### Step 3: Validate and Enrich Asset Data\n\nCross-reference discovered assets against known inventories and enrich with vulnerability data.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Asset Validation and Enrichment Tool.\n\nCross-references Claroty discovery results against existing CMDB\nand enriches with NVD vulnerability data.\n\"\"\"\n\nimport json\nimport csv\nimport sys\nfrom datetime import datetime\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass AssetValidator:\n    \"\"\"Validates and enriches OT asset inventory.\"\"\"\n\n    def __init__(self, inventory_file: str):\n        self.discovered_assets = []\n        self.load_inventory(inventory_file)\n        self.discrepancies = []\n\n    def load_inventory(self, filepath: str):\n        \"\"\"Load Claroty-discovered asset inventory.\"\"\"\n        with open(filepath, \"r\") as f:\n            reader = csv.DictReader(f)\n            self.discovered_assets = list(reader)\n        print(f\"[*] Loaded {len(self.discovered_assets)} discovered assets\")\n\n    def compare_with_cmdb(self, cmdb_file: str):\n        \"\"\"Compare discovered assets against CMDB records.\"\"\"\n        with open(cmdb_file, \"r\") as f:\n            cmdb_assets = {row[\"ip_address\"]: row for row in csv.DictReader(f)}\n\n        discovered_ips = {a[\"ip_address\"] for a in self.discovered_assets if a[\"ip_address\"]}\n        cmdb_ips = set(cmdb_assets.keys())\n\n        shadow_devices = discovered_ips - cmdb_ips\n        missing_devices = cmdb_ips - discovered_ips\n\n        print(f\"\\n{'='*60}\")\n        print(\"ASSET INVENTORY VALIDATION REPORT\")\n        print(f\"{'='*60}\")\n        print(f\"Discovered assets: {len(discovered_ips)}\")\n        print(f\"CMDB records: {len(cmdb_ips)}\")\n        print(f\"Shadow OT devices (not in CMDB): {len(shadow_devices)}\")\n        print(f\"Missing devices (in CMDB, not seen): {len(missing_devices)}\")\n\n        if shadow_devices:\n            print(f\"\\n  SHADOW DEVICES (Unauthorized\u002FUndocumented):\")\n            for ip in sorted(shadow_devices):\n                asset = next((a for a in self.discovered_assets if a[\"ip_address\"] == ip), {})\n                print(f\"    - {ip} | {asset.get('vendor', 'Unknown')} {asset.get('model', '')} | Type: {asset.get('type', 'Unknown')}\")\n                self.discrepancies.append({\n                    \"type\": \"SHADOW_DEVICE\",\n                    \"severity\": \"HIGH\",\n                    \"ip\": ip,\n                    \"detail\": f\"Undocumented {asset.get('type', 'device')} from {asset.get('vendor', 'unknown vendor')}\",\n                })\n\n        if missing_devices:\n            print(f\"\\n  MISSING DEVICES (Expected but not seen):\")\n            for ip in sorted(missing_devices):\n                cmdb = cmdb_assets[ip]\n                print(f\"    - {ip} | {cmdb.get('name', 'Unknown')} | Last CMDB update: {cmdb.get('last_updated', 'N\u002FA')}\")\n                self.discrepancies.append({\n                    \"type\": \"MISSING_DEVICE\",\n                    \"severity\": \"MEDIUM\",\n                    \"ip\": ip,\n                    \"detail\": f\"CMDB asset {cmdb.get('name', ip)} not seen on network\",\n                })\n\n    def check_firmware_vulnerabilities(self, asset):\n        \"\"\"Check NVD for known vulnerabilities matching asset firmware.\"\"\"\n        vendor = asset.get(\"vendor\", \"\").lower()\n        model = asset.get(\"model\", \"\").lower()\n        firmware = asset.get(\"firmware_version\", \"\")\n\n        if not vendor or not model:\n            return []\n\n        search_term = f\"{vendor} {model}\"\n        try:\n            resp = requests.get(\n                \"https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0\",\n                params={\"keywordSearch\": search_term, \"resultsPerPage\": 10},\n                timeout=15,\n            )\n            if resp.status_code == 200:\n                data = resp.json()\n                return data.get(\"vulnerabilities\", [])\n        except requests.RequestException:\n            pass\n        return []\n\n    def generate_risk_summary(self):\n        \"\"\"Generate risk-prioritized summary of findings.\"\"\"\n        print(f\"\\n{'='*60}\")\n        print(\"RISK SUMMARY\")\n        print(f\"{'='*60}\")\n\n        high_risk = [a for a in self.discovered_assets if float(a.get(\"risk_score\", 0)) >= 7]\n        end_of_life = [a for a in self.discovered_assets if a.get(\"firmware_version\", \"\").startswith(\"v1.\")]\n        no_encryption = [a for a in self.discovered_assets if \"modbus\" in a.get(\"protocol\", \"\").lower()]\n\n        print(f\"  High-risk assets (score >= 7): {len(high_risk)}\")\n        print(f\"  Potentially end-of-life firmware: {len(end_of_life)}\")\n        print(f\"  Assets using unencrypted protocols: {len(no_encryption)}\")\n        print(f\"  Inventory discrepancies: {len(self.discrepancies)}\")\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(\"Usage: python validate_assets.py \u003Cclaroty_export.csv> [cmdb_export.csv]\")\n        sys.exit(1)\n\n    validator = AssetValidator(sys.argv[1])\n    if len(sys.argv) >= 3:\n        validator.compare_with_cmdb(sys.argv[2])\n    validator.generate_risk_summary()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Passive Monitoring | Observing mirrored network traffic via SPAN\u002FTAP without injecting packets, safe for all OT devices |\n| Active Querying | Sending native protocol requests to extract detailed device information; requires careful scheduling |\n| Claroty Edge | Claroty's safe active discovery collector that uses native industrial protocols rather than IT scanning |\n| Purdue Level | Hierarchical classification of industrial network assets from Level 0 (physical process) to Level 5 (enterprise) |\n| Shadow OT Device | Asset connected to the OT network that is not documented in the asset management system |\n| xDome | Claroty's SaaS-based cyber-physical systems protection platform providing visibility, risk management, and threat detection |\n\n## Common Scenarios\n\n### Scenario: Brownfield Factory Asset Discovery\n\n**Context**: A manufacturing plant with 20 years of equipment additions needs a complete OT asset inventory for an IEC 62443 risk assessment. No accurate asset records exist.\n\n**Approach**:\n1. Deploy Claroty sensors on SPAN ports at each major network segment (control, supervisory, DMZ)\n2. Allow passive monitoring for 2-4 weeks to capture all regular communication patterns\n3. Schedule Claroty Edge active queries during a planned maintenance window\n4. Export discovered inventory and categorize assets by Purdue level, vendor, and criticality\n5. Cross-reference against any existing documentation (P&ID diagrams, network drawings)\n6. Identify shadow devices and initiate a review process with plant operations\n7. Feed validated inventory into IEC 62443 zone and conduit risk assessment\n\n**Pitfalls**: Do not rush active discovery before passive monitoring has captured baseline traffic patterns. Never use IT vulnerability scanners (Nessus active scans) directly against PLCs or RTUs -- this can crash legacy controllers. Always exclude Safety Instrumented Systems (SIS) from active queries.\n\n## Output Format\n\n```\nICS ASSET DISCOVERY REPORT\n============================\nDate: YYYY-MM-DD\nPlatform: Claroty xDome\nSite: [Site Name]\n\nDISCOVERY SUMMARY:\n  Total Assets Discovered: [count]\n  New Assets (not in CMDB): [count]\n  High-Risk Assets: [count]\n\nPURDUE LEVEL DISTRIBUTION:\n  Level 0 (Process): [count] assets\n  Level 1 (Control): [count] assets\n  Level 2 (Supervisory): [count] assets\n  Level 3 (Operations): [count] assets\n  Level 3.5 (DMZ): [count] assets\n  Level 4-5 (Enterprise): [count] assets\n\nTOP VENDORS:\n  1. [Vendor] - [count] devices\n  2. [Vendor] - [count] devices\n\nCRITICAL FINDINGS:\n  - [Shadow device description]\n  - [End-of-life firmware finding]\n  - [Unencrypted protocol concern]\n```\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":31,"maxTurns":54,"nist_csf":55,"subdomain":60,"description":7,"nist_ai_rmf":61,"mitre_attack":65,"atlas_techniques":68},[45,24,26,23,27,46,28,47],"ot-security","scada","iec62443",[],"sonnet",[51,29,52,53],"Read","Glob","Grep",20,[56,57,58,59],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security",[62,63,64],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[66,67],"T0855","T1082",[69,70,71],"AML.T0070","AML.T0066","AML.T0082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Findustrial\u002Fics\u002Fasset-management\u002Fclaroty\u002Fdiscover\u002Fmonitor","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-asset-management-claroty-discover-monitor",{"tool":85,"command":86},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-asset-management-claroty-discover-monitor",{"tool":88,"command":89},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-asset-management-claroty-discover-monitor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fasset-management\u002Fclaroty\u002Fdiscover\u002Fmonitor\u002FSKILL.md",true,[93],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"index.json","REFERENCE","参考文档",756,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fasset-management\u002Fclaroty\u002Fdiscover\u002Fmonitor\u002Findex.json",[100,123,144,165,187,203],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[107,108,109,110,111,36,33,112,113,114,115,116,117,118,119,120,121,31,122],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[130,107,131,110,132,133,134,31,29,135,136,35,137,138,36,139,140,141,142,143],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[151,152,153,154,155,156,31,29,157,135,158,159,36,141,160,161,162,163,164,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[108,172,173,174,175,176,177,33,178,31,122,179,180,181,182,183,184,185,186,36],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[194,195,108,196,174,176,197,33,198,178,31,122,135,199,200,201,202,186,36,112],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[210,108,174,211,197,33,212,213,31,122,214,215,216,217,218,219,36,112,220,221],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]