Network Passive Discovery

Name: Network Passive Discovery
Author: sodejm

ASecurity

Normalize passive asset telemetry, preserve multi-source evidence provenance, and reconcile scope quarantine.

2 stars
0 votes
0 copies
1 view
Added October 15, 2026

securitypythonbash

Works with

Security analysis

A100/100

Scanned October 15, 2026

npx -y skills add sodejm/copilot-operation-plugin-for-security --skill network-passive-discovery --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Network Passive Discovery?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Network Passive Discovery

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/sodejm-network-passive-discovery-copilot-operation-plugin-for-s/badge)](https://www.skillsdirectory.com/skills/sodejm-network-passive-discovery-copilot-operation-plugin-for-s)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: network-passive-discovery
description: Normalize passive asset telemetry, preserve multi-source evidence provenance, and reconcile scope quarantine.
---

# Network passive discovery

1. **Ingest and Normalize Telemetry**:
   - Collect and normalize multi-source DNS records, certificate transparency logs, IP allocations, endpoints, and cloud exports without active scanning.
   - Bind every record to an immutable `EvidenceProvenance` envelope containing SHA-256 digest and collection timestamp.

2. **Deduplicate Observations**:
   - Merge overlapping observations of identical network entities while retaining multi-source provenance lineages.
   - Detect conflicting ownership or tenant identities across merged evidence streams.

3. **Reconcile Scope Quarantine**:
   - Classify all assets against authorized engagement boundaries into `verified_in_scope`, `quarantined`, or `excluded`.
   - Quarantine assets with uncertain ownership, conflicting attributes, stale pointers, or missing provenance so discovery cannot expand engagement boundaries.

4. **CLI Invocation**:
   ```bash
   python3 -m cops discovery normalize <records.json> --type dns --output inventory.json
   python3 -m cops discovery reconcile inventory.json --scope scope.json --output reconciled.json
   python3 -m cops discovery merge inv1.json inv2.json --output merged.json
   python3 -m cops discovery inspect inventory.json
   ```