Implements microsegmentation with Akamai Guardicore Segmentation: deploys agents on Linux/Windows/Kubernetes, maps app dependencies, visualizes east-west traffic, enforces least-privilege policies across data centers and clouds.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 实施东西向流量控制以防止数据中心内的横向移动(Lateral Movement)
Deploys Akamai Guardicore agents on Linux, Windows, Kubernetes to map app dependencies, visualize east-west traffic, create granular policies, and enforce zero-trust segmentation across data centers/cloud.
Implements microsegmentation with Akamai Guardicore: maps app dependencies, creates granular policies, visualizes east-west traffic, enforces least-privilege across data centers/cloud. For zero-trust network security.
Configures microsegmentation for zero-trust architectures to enforce least-privilege access between workloads at application layer, preventing lateral movement and replacing VLANs. Uses Illumio, VMware NSX, Guardicore.
Share bugs, ideas, or general feedback.
不适用于仅做边界安全(使用传统防火墙)、工作负载少于 50 个且 VLAN/安全组已足够的环境,或网络团队没有能力持续进行策略管理的场景。
安装 Agent 以采集进程级网络通信数据。
# Linux agent 安装
curl -sSL https://management.guardicore.com/api/v3.0/agents/download/linux \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-o gc-agent-installer.sh
chmod +x gc-agent-installer.sh
sudo ./gc-agent-installer.sh \
--management-url=https://management.guardicore.com \
--site-id=datacenter-east \
--label="web-tier"
# Windows agent 安装 (PowerShell)
# Invoke-WebRequest -Uri "https://management.guardicore.com/api/v3.0/agents/download/windows" `
# -Headers @{"Authorization"="Bearer $GC_API_TOKEN"} `
# -OutFile gc-agent-installer.exe
# Start-Process -FilePath .\gc-agent-installer.exe `
# -ArgumentList "--management-url=https://management.guardicore.com","--site-id=datacenter-east" `
# -Wait
# Kubernetes DaemonSet 部署
cat > gc-daemonset.yaml << 'EOF'
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: guardicore-agent
namespace: guardicore
spec:
selector:
matchLabels:
app: gc-agent
template:
metadata:
labels:
app: gc-agent
spec:
hostNetwork: true
hostPID: true
containers:
- name: gc-agent
image: guardicore/agent:latest
securityContext:
privileged: true
env:
- name: GC_MANAGEMENT_URL
value: "https://management.guardicore.com"
- name: GC_API_KEY
valueFrom:
secretKeyRef:
name: gc-credentials
key: api-key
volumeMounts:
- mountPath: /host
name: host-root
volumes:
- name: host-root
hostPath:
path: /
EOF
kubectl apply -f gc-daemonset.yaml
# 验证 Agent 注册状态
curl -s "https://management.guardicore.com/api/v3.0/agents?status=active" \
-H "Authorization: Bearer ${GC_API_TOKEN}" | python3 -m json.tool
使用 Guardicore Reveal 发现并可视化应用程序通信模式。
# 通过 API 查询已发现的应用流量
curl -s "https://management.guardicore.com/api/v3.0/connections" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{
"time_range": {"from": "2026-02-17T00:00:00Z", "to": "2026-02-24T00:00:00Z"},
"filter": {
"source_label": "web-tier",
"destination_label": "app-tier"
},
"aggregation": "process",
"limit": 1000
}' | python3 -m json.tool
# 导出应用程序依赖关系图
curl -s "https://management.guardicore.com/api/v3.0/maps/export" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{
"format": "json",
"labels": ["web-tier", "app-tier", "db-tier"],
"time_range": "7d"
}' -o app-dependency-map.json
# 典型发现结果:
# web-tier -> app-tier: TCP 8080, 8443 (预期流量)
# app-tier -> db-tier: TCP 5432, 3306 (预期流量)
# web-tier -> db-tier: TCP 5432 (异常流量 - 应当阻断)
# app-tier -> internet: TCP 443 (验证是否需要)
定义标签并围绕应用程序创建环形隔离策略。
# 为应用层创建标签
curl -X POST "https://management.guardicore.com/api/v3.0/labels" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"name": "PCI-CDE",
"description": "Cardholder Data Environment workloads",
"criteria": {"ip_ranges": ["10.10.0.0/16"]},
"color": "#FF0000"
}'
# 创建分段策略:允许 web 层到 app 层的通信
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"name": "Web-to-App Allowed",
"action": "ALLOW",
"priority": 100,
"source": {"labels": ["web-tier"]},
"destination": {"labels": ["app-tier"]},
"services": [
{"protocol": "TCP", "port": 8080},
{"protocol": "TCP", "port": 8443}
],
"log": true,
"enabled": true,
"section": "application-segmentation"
}'
# 创建拒绝策略:阻断 web 层直接访问数据库
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"name": "Block Web-to-DB Direct",
"action": "DENY",
"priority": 200,
"source": {"labels": ["web-tier"]},
"destination": {"labels": ["db-tier"]},
"services": [{"protocol": "TCP", "port_range": "1-65535"}],
"log": true,
"alert": true,
"enabled": true
}'
# 为 PCI CDE 创建环形隔离策略
curl -X POST "https://management.guardicore.com/api/v3.0/policies" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"name": "PCI CDE Ring Fence",
"action": "DENY",
"priority": 50,
"source": {"labels": ["!PCI-CDE"]},
"destination": {"labels": ["PCI-CDE"]},
"services": [{"protocol": "TCP", "port_range": "1-65535"}],
"log": true,
"alert": true,
"enabled": true
}'
在不阻断流量的情况下模拟策略执行。
# 为新策略启用 reveal 模式(仅记录日志)
curl -X PATCH "https://management.guardicore.com/api/v3.0/policies/POLICY_ID" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{"enforcement_mode": "REVEAL"}'
# 在 reveal 模式下检查哪些流量将被阻断
curl -s "https://management.guardicore.com/api/v3.0/violations" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{
"time_range": "24h",
"policy_id": "POLICY_ID",
"limit": 100
}' | python3 -c "
import json, sys
data = json.load(sys.stdin)
for v in data.get('violations', []):
print(f\"{v['source_ip']}:{v['source_process']} -> {v['dest_ip']}:{v['dest_port']} [{v['action']}]\")
"
# 验证通过后,切换到执行模式
curl -X PATCH "https://management.guardicore.com/api/v3.0/policies/POLICY_ID" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{"enforcement_mode": "ENFORCE"}'
配置告警并持续监控分段违规情况。
# 配置 SIEM 集成以接收策略违规事件
curl -X POST "https://management.guardicore.com/api/v3.0/integrations/syslog" \
-H "Authorization: Bearer ${GC_API_TOKEN}" \
-d '{
"name": "Splunk SIEM",
"host": "splunk-syslog.company.com",
"port": 514,
"protocol": "TCP",
"format": "CEF",
"events": ["policy_violation", "agent_status", "deception_alert"]
}'
# Splunk 查询微分段违规事件
# index=guardicore sourcetype=guardicore:policy
# | where action="DENY" AND enforcement_mode="ENFORCE"
# | stats count by src_ip, dst_ip, dst_port, policy_name
# | sort -count
| 术语 | 定义 |
|---|---|
| 微分段(Microsegmentation) | 一种网络安全技术,围绕单个工作负载或应用程序创建细粒度安全区域,以控制东西向流量 |
| Reveal 模式 | Guardicore 的模拟模式,记录策略决策但不执行,允许在阻断前进行验证 |
| 环形隔离策略(Ring-Fence Policy) | 限制定义资产组(如 PCI CDE)所有进出流量的隔离策略 |
| 应用程序依赖关系图(Application Dependency Map) | 工作负载之间已发现网络通信模式的可视化表示,显示进程、端口和协议 |
| 东西向流量(East-West Traffic) | 在数据中心内工作负载之间横向流动的网络流量,与跨越边界的南北向流量相对 |
| 进程级可见性(Process-Level Visibility) | Guardicore 识别工作负载上哪个进程发起或接收网络连接的能力 |
场景背景:一家电商公司必须将其持卡人数据环境(Cardholder Data Environment,CDE)与企业网络其余部分隔离,以满足 PCI DSS 合规要求。CDE 跨越本地和 AWS 上的 200 台服务器。
方法:
常见陷阱:在旧系统(Windows Server 2012)上部署 Agent 可能需要手动安装。环形隔离策略必须考虑管理流量(监控、补丁、备份)。从宽泛的允许规则开始,逐步收紧。应用程序负责人必须在执行前验证依赖关系图。
微分段部署报告
==================================================
组织:E-Commerce Corp
报告日期:2026-02-23
AGENT 部署情况:
工作负载总数: 500
已安装 Agent: 487 (97.4%)
活跃 Agent: 482 (98.9%)
无 Agent(流日志): 13
策略覆盖情况:
策略总数: 45
允许规则: 38
拒绝规则: 7
Reveal 模式: 3
已执行: 42
流量分析(7 天):
观察到的总流量: 2,456,789
匹配允许规则: 2,441,234 (99.4%)
匹配拒绝规则: 15,555 (0.6%)
未分类流量: 0
PCI CDE 隔离情况:
CDE 工作负载: 200
环形隔离违规: 0(近 30 天)
授权 CDE 入口点: 4
已阻断横向移动路径: 95%