القائمة
Applies M365NetIsoNsg compliance rules to an existing Azure NSG and outputs the ARM template for Safe Deployment.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/aibot88/sec_skill_store --skill remediate-nsgيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
Guía técnica completa para integrar 250+ servicios externos con agentes IA usando Composio. Cubre instalación, autenticación OAuth, gestión de herramientas, triggers y flujos multi-servicio.
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| type | skill |
| lifecycle | stable |
| inheritance | inheritable |
| name | remediate-nsg |
| description | Applies M365NetIsoNsg compliance rules to an existing Azure NSG and outputs the ARM template for Safe Deployment. |
| tier | standard |
| applyTo | **/*remediate*,**/*nsg* |
| currency | 2026-04-30T00:00:00.000Z |
| lastReviewed | 2026-04-30T00:00:00.000Z |
Applies M365NetIsoNsg compliance rules to an existing Azure NSG and outputs the ARM template for Safe Deployment.
Required inputs: NSG name, resource group, subscription ID, environment (Production/Non-Production).
Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$nsg = Get-AzNetworkSecurityGroup -Name "<NSG_NAME>" -ResourceGroupName "<RESOURCE_GROUP>"
$nsg.SecurityRules | Select-Object Name, Priority, Access, Direction, Protocol, SourceAddressPrefix, DestinationPortRange | Format-Table -AutoSize
Show existing rules. If any rules occupy priority 100-119, STOP and warn — they must be moved to 120+ first. Get user confirmation before proceeding.
The only difference between Production and Non-Production is Rule 100:
SourceAddressPrefix "M365RemoteDesktopGateway"SourceAddressPrefix @("M365RemoteDesktopGateway","CorpNetSaw","CorpNetPublic")Rules 101-106 are identical for both environments.
Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$nsg = Get-AzNetworkSecurityGroup -Name "<NSG_NAME>" -ResourceGroupName "<RESOURCE_GROUP>"
# Rule 100 — Production: "M365RemoteDesktopGateway" | Non-Prod: @("M365RemoteDesktopGateway","CorpNetSaw","CorpNetPublic")
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-AllowRAv3SAWGateways" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Allow -Protocol * -Direction Inbound -Priority 100 -SourceAddressPrefix <SEE_ABOVE> -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389 | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-AllowVirtualNetwork" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Allow -Protocol * -Direction Inbound -Priority 101 -SourceAddressPrefix "VirtualNetwork" -SourcePortRange * -DestinationAddressPrefix "VirtualNetwork" -DestinationPortRange * | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-AllowPortsFromSAWs" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Allow -Protocol * -Direction Inbound -Priority 102 -SourceAddressPrefix "CorpNetSaw" -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange * | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-AllowTorusManagement" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Allow -Protocol * -Direction Inbound -Priority 103 -SourceAddressPrefix @("13.107.6.152/31","13.107.9.152/31","13.107.18.10/31","13.107.19.10/31","13.107.128.0/22","23.103.160.0/20","23.103.224.0/19","40.96.0.0/13","40.104.0.0/15","52.96.0.0/14","70.37.151.128/25","111.221.112.0/21","131.253.33.215/32","132.245.0.0/16","134.170.68.0/23","150.171.32.0/22","157.56.96.16/28","157.56.96.224/28","157.56.232.0/21","157.56.240.0/20","191.232.96.0/19","191.234.6.152/32","191.234.140.0/22","191.234.224.0/22","204.79.197.215/32","206.191.224.0/19") -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 9796 | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-AllowLoadBalancer" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Allow -Protocol * -Direction Inbound -Priority 104 -SourceAddressPrefix "AzureLoadBalancer" -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange * | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-DenyTorusManagementFromInternet" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Deny -Protocol * -Direction Inbound -Priority 105 -SourceAddressPrefix "Internet" -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 9796 | Set-AzNetworkSecurityGroup
$nsg | Add-AzNetworkSecurityRuleConfig -Name "M365-NetIso-DenyHighRiskPorts" -Description "Please see https://aka.ms/M365NetIsoWiki for more info." -Access Deny -Protocol * -Direction Inbound -Priority 106 -SourceAddressPrefix "Internet" -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange @("13","17","19","20","21","22","23","53","69","111","115","119","123","135","137","138","139","161","162","389","445","512","514","593","636","873","1337","1433","1434","1801","1900","2049","2301","2381","3268","3306","3389","3637","4333","5353","5432","5601","5723","5724","5800","5900","5984","5985","5986","6379","6984","7000","7001","7199","7473","7474","7687","8888","9042","9142","9160","9200","9300","9798","9987","11211","15000","16379","19888","26379","27017","27018","27019","28017","42080","50030","50060","50070","50090","50075","50111","61620","61621","3702","19000","19080") | Set-AzNetworkSecurityGroup
$nsg = Get-AzNetworkSecurityGroup -Name "<NSG_NAME>" -ResourceGroupName "<RESOURCE_GROUP>"
$nsg.SecurityRules | Select-Object Name, Priority, Access, Direction, SourceAddressPrefix, DestinationPortRange | Format-Table -AutoSize
Confirm all 7 rules are present at priorities 100-106.
Generate the ARM template JSON. The only difference between environments is Rule 100:
"sourceAddressPrefix": "M365RemoteDesktopGateway" with "sourceAddressPrefixes": []"sourceAddressPrefix": "" with "sourceAddressPrefixes": ["M365RemoteDesktopGateway","CorpNetSaw","CorpNetPublic"]{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"networkSecurityGroupName": {
"type": "string",
"defaultValue": "<NSG_NAME>",
"metadata": { "description": "Your NSG name goes here" }
}
},
"variables": { "location": "[resourceGroup().location]" },
"resources": [{
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2020-05-01",
"name": "[parameters('networkSecurityGroupName')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "M365-NetIso-AllowRAv3SAWGateways",
"properties": {
"priority": 100, "access": "Allow", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "<PROD: M365RemoteDesktopGateway | NON-PROD: empty string>",
"sourceAddressPrefixes": "<PROD: [] | NON-PROD: [M365RemoteDesktopGateway, CorpNetSaw, CorpNetPublic]>",
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "3389", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-AllowVirtualNetwork",
"properties": {
"priority": 101, "access": "Allow", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "VirtualNetwork", "sourceAddressPrefixes": [],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "VirtualNetwork", "destinationAddressPrefixes": [],
"destinationPortRange": "*", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-AllowPortsFromSAWs",
"properties": {
"priority": 102, "access": "Allow", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "CorpNetSaw", "sourceAddressPrefixes": [],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "*", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-AllowTorusManagement",
"properties": {
"priority": 103, "access": "Allow", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefixes": [
"13.107.6.152/31","13.107.9.152/31","13.107.18.10/31","13.107.19.10/31",
"13.107.128.0/22","23.103.160.0/20","23.103.224.0/19","40.96.0.0/13",
"40.104.0.0/15","52.96.0.0/14","70.37.151.128/25","111.221.112.0/21",
"131.253.33.215/32","132.245.0.0/16","134.170.68.0/23","150.171.32.0/22",
"157.56.96.16/28","157.56.96.224/28","157.56.232.0/21","157.56.240.0/20",
"191.232.96.0/19","191.234.6.152/32","191.234.140.0/22","191.234.224.0/22",
"204.79.197.215/32","206.191.224.0/19"
],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "9796", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-AllowLoadBalancer",
"properties": {
"priority": 104, "access": "Allow", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "AzureLoadBalancer", "sourceAddressPrefixes": [],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "*", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-DenyTorusManagementFromInternet",
"properties": {
"priority": 105, "access": "Deny", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "Internet", "sourceAddressPrefixes": [],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "9796", "destinationPortRanges": [],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
},
{
"name": "M365-NetIso-DenyHighRiskPorts",
"properties": {
"priority": 106, "access": "Deny", "direction": "Inbound", "protocol": "*",
"sourceAddressPrefix": "Internet", "sourceAddressPrefixes": [],
"sourcePortRange": "*", "sourcePortRanges": [],
"destinationAddressPrefix": "*", "destinationAddressPrefixes": [],
"destinationPortRange": "",
"destinationPortRanges": ["13","17","19","20","21","22","23","53","69","111","115","119","123","135","137","138","139","161","162","389","445","512","514","593","636","873","1337","1433","1434","1801","1900","2049","2301","2381","3268","3306","3389","3637","4333","5353","5432","5601","5723","5724","5800","5900","5984","5985","5986","6379","6984","7000","7001","7199","7473","7474","7687","8888","9042","9142","9160","9200","9300","9798","9987","11211","15000","16379","19888","26379","27017","27018","27019","28017","42080","50030","50060","50070","50090","50075","50111","61620","61621","3702","19000","19080"],
"description": "Created by M365 Core Network Security managed policy. Please see https://aka.ms/M365NetIsoWiki for more info."
}
}
]
}
}]
}
Also output a parameters file:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"networkSecurityGroupName": { "value": "<NSG_NAME>" }
}
}
Replace <NSG_NAME> with the actual NSG name.