Skip to main content
implementing-microsegmentation-with-guardicore Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-microsegmentation-with-guardicoreEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Explorador de archivos
4 archivos Más de este repositorio abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
name implementing-microsegmentation-with-guardicore description Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.
domain cybersecurity subdomain zero-trust-architecture tags ["microsegmentation","guardicore","akamai","zero-trust","east-west-traffic","network-segmentation","lateral-movement"] version 1.0 author mahipal license Apache-2.0 nist_csf ["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"] mitre_attack ["T1078","T1190","T1059","T1021","T1550"]
Implementing Microsegmentation with Guardicore
When to Use
When implementing east-west traffic controls to prevent lateral movement within data centers
When needing application-level visibility into network communication patterns before writing segmentation policies
When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)
When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation
When deploying zero trust at the network layer with process-level granularity
Do not use for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs/security groups suffice, or when network team lacks capacity for ongoing policy management.
Prerequisites
Akamai Guardicore Segmentation license (Enterprise or Premium)
Guardicore Management Server deployed (on-prem or SaaS)
Agent deployment access to target workloads (Linux, Windows, Kubernetes)
Network visibility: SPAN/TAP ports or VPC flow logs for agentless collection
Application owner engagement for dependency validation
Workflow
Step 1: Deploy Guardicore Agents on Workloads
Install agents to collect process-level network communication data.
curl -sSL https://management.guardicore.com/api/v3.0/agents/download/linux \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-o gc-agent-installer.sh
chmod +x gc-agent-installer.sh
sudo ./gc-agent-installer.sh \
--management-url=https://management.guardicore.com \
--site-id=datacenter-east \
--label="web-tier"
cat > gc-daemonset.yaml << 'EOF'
true
true
true
env
"https://management.guardicore.com"
"https://management.guardicore.com/api/v3.0/agents?status=active"
"Authorization: Bearer ${GC_API_TOKEN} "
Step 2: Map Application Dependencies with Reveal Use Guardicore Reveal to discover and visualize application communication patterns.
curl -s "https://management.guardicore.com/api/v3.0/connections" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{
"time_range": {"from": "2026-02-17T00:00:00Z", "to": "2026-02-24T00:00:00Z"},
"filter": {
"source_label": "web-tier",
"destination_label": "app-tier"
},
"aggregation": "process",
"limit": 1000
}' | python3 -m json.tool
curl -s "https://management.guardicore.com/api/v3.0/maps/export" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{
"format": "json",
"labels": ["web-tier", "app-tier", "db-tier"],
"time_range": "7d"
}' -o app-dependency-map.json
Step 3: Create Segmentation Labels and Policies Define labels and create ring-fence policies around applications.
curl -X POST "https://management.guardicore.com/api/v3.0/labels" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-H "Content-Type: application/json" \
-d '{
"name": "PCI-CDE",
"description": "Cardholder Data Environment workloads",
"criteria": {"ip_ranges": ["10.10.0.0/16"]},
"color": "#FF0000"
}'
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-H "Content-Type: application/json" \
-d '{
"name": "Web-to-App Allowed",
"action": "ALLOW",
"priority": 100,
"source": {"labels": ["web-tier"]},
"destination": {"labels": ["app-tier"]},
"services": [
{"protocol": "TCP", "port": 8080},
{"protocol": "TCP", "port": 8443}
],
"log": true,
"enabled": true,
"section": "application-segmentation"
}'
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-H "Content-Type: application/json" \
-d '{
"name": "Block Web-to-DB Direct",
"action": "DENY",
"priority": 200,
"source": {"labels": ["web-tier"]},
"destination": {"labels": ["db-tier"]},
"services": [{"protocol": "TCP", "port_range": "1-65535"}],
"log": true,
"alert": true,
"enabled": true
}'
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-H "Content-Type: application/json" \
-d '{
"name": "PCI CDE Ring Fence",
"action": "DENY",
"priority": 50,
"source": {"labels": ["!PCI-CDE"]},
"destination": {"labels": ["PCI-CDE"]},
"services": [{"protocol": "TCP", "port_range": "1-65535"}],
"log": true,
"alert": true,
"enabled": true
}'
Step 4: Test Policies in Reveal Mode Before Enforcement Simulate policy enforcement without blocking traffic.
curl -X PATCH "https://management.guardicore.com/api/v3.0/policies/POLICY_ID" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{"enforcement_mode": "REVEAL"}'
curl -s "https://management.guardicore.com/api/v3.0/violations" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{
"time_range": "24h",
"policy_id": "POLICY_ID",
"limit": 100
}' | python3 -c "
import json, sys
data = json.load(sys.stdin)
for v in data.get('violations', []):
print(f\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\")
"
curl -X PATCH "https://management.guardicore.com/api/v3.0/policies/POLICY_ID" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{"enforcement_mode": "ENFORCE"}'
Step 5: Monitor and Respond to Policy Violations Set up alerting and continuous monitoring for segmentation violations.
curl -X POST "https://management.guardicore.com/api/v3.0/integrations/syslog" \
-H "Authorization: Bearer ${GC_API_TOKEN} " \
-d '{
"name": "Splunk SIEM",
"host": "splunk-syslog.company.com",
"port": 514,
"protocol": "TCP",
"format": "CEF",
"events": ["policy_violation", "agent_status", "deception_alert"]
}'
Key Concepts Term Definition Microsegmentation Network security technique creating granular security zones around individual workloads or applications to control east-west traffic Reveal Mode Guardicore's simulation mode that logs policy decisions without enforcing them, allowing validation before blocking Ring-Fence Policy Isolation policy that restricts all traffic into or out of a defined group of assets (e.g., PCI CDE) Application Dependency Map Visual representation of discovered network communication patterns between workloads showing processes, ports, and protocols East-West Traffic Network traffic flowing laterally between workloads within a data center, as opposed to north-south traffic crossing the perimeter Process-Level Visibility Guardicore's ability to identify which process on a workload initiated or received a network connection
Tools & Systems
Akamai Guardicore Segmentation : Agent-based microsegmentation platform with application visualization and policy enforcementGuardicore Reveal : Network visualization engine mapping application dependencies across hybrid environmentsGuardicore Centra : Management console for policy creation, monitoring, and incident investigationGuardicore Agents : Lightweight agents deployed on workloads collecting process-level network telemetryGuardicore Insight : Analytics engine for compliance reporting and segmentation effectiveness measurement
Common Scenarios
Scenario: PCI DSS Microsegmentation for E-Commerce Platform Context : An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.
Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers
Run Reveal for 2 weeks to map all communication patterns into and out of the CDE
Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)
Create ring-fence policy blocking all non-CDE to CDE traffic by default
Create explicit allow policies for validated CDE communication paths
Test in Reveal mode for 1 week, validate no legitimate traffic blocked
Switch to enforcement mode and monitor for violations
Generate PCI DSS segmentation validation report showing enforced controls
Pitfalls : Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.
Output Format Microsegmentation Deployment Report
==================================================
Organization: E-Commerce Corp
Report Date: 2026-02-23
AGENT DEPLOYMENT:
Total workloads: 500
Agents installed: 487 (97.4%)
Agents active: 482 (98.9%)
Agentless (flow logs): 13
POLICY COVERAGE:
Total policies: 45
Allow rules: 38
Deny rules: 7
Reveal mode: 3
Enforced: 42
TRAFFIC ANALYSIS (7 days):
Total flows observed: 2,456,789
Flows matching allow: 2,441,234 (99.4%)
Flows matching deny: 15,555 (0.6%)
Unclassified flows: 0
PCI CDE ISOLATION:
CDE workloads: 200
Ring-fence violations: 0 (last 30 days)
Authorized CDE entry points: 4
Lateral movement paths blocked: 95%
