{"id":"3c7e8bf0-4800-4ed2-973d-0ca74e352fb6","shortId":"5WAcMs","kind":"skill","title":"azure-external-attack-surface-management","tagline":"Expert knowledge for Azure External Attack Surface Management development including limits & quotas, configuration, and integrations & coding patterns. Use when querying EASM assets, setting policy rules, exporting to Log Analytics or Data Explorer, or estimating billing, and oth","description":"# Azure External Attack Surface Management Skill\n\nThis skill provides expert guidance for Azure External Attack Surface Management. Covers limits & quotas, configuration, and integrations & coding patterns. It combines local quick-reference content with remote documentation fetching capabilities.\n\n## How to Use This Skill\n\n> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file\n\n> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)\n\nThis skill requires **network access** to fetch documentation content:\n- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.\n- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.\n\n## Category Index\n\n| Category | Lines | Description |\n|----------|-------|-------------|\n| Limits & Quotas | L31-L35 | Explains how Defender EASM billing works, what counts as a billable asset, and how asset counts affect costs and quotas. |\n| Configuration | L36-L49 | Filtering and querying EASM inventory by asset type (domains, hosts, IPs/blocks, ASNs, pages, contacts, SSL certs) and configuring policy engine automation rules. |\n| Integrations & Coding Patterns | L50-L53 | Configuring Defender EASM to export discovery and asset data into Log Analytics and Azure Data Explorer, including connection setup and data usage for analysis. |\n\n### Limits & Quotas\n| Topic | URL |\n|-------|-----|\n| Understand Defender EASM billing and billable asset counts | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-billable-assets |\n\n### Configuration\n| Topic | URL |\n|-------|-----|\n| Use ASN asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/asn-asset-filters |\n| Use contact asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/contact-asset-filters |\n| Apply domain asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/domain-asset-filters |\n| Apply host asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/host-asset-filters |\n| Use Defender EASM inventory filters and saved queries | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/inventory-filters |\n| Use IP address asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-address-asset-filters |\n| Use IP block asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-block-asset-filters |\n| Apply page asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/page-asset-filters |\n| Configure Defender EASM policy engine automation rules | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/policy-engine |\n| Use SSL certificate asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ssl-certificate-asset-filters |\n\n### Integrations & Coding Patterns\n| Topic | URL |\n|-------|-----|\n| Configure Defender EASM data connections to Log Analytics and ADX | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/data-connections |","tags":["azure","external","attack","surface","management","agent","skills","microsoftdocs","agent-skills","agentic-skills","agentskill","ai-agents"],"capabilities":["skill","source-microsoftdocs","skill-azure-external-attack-surface-management","topic-agent","topic-agent-skills","topic-agentic-skills","topic-agentskill","topic-ai-agents","topic-ai-coding","topic-azure","topic-azure-functions","topic-azure-kubernetes-service","topic-azure-openai","topic-azure-sql-database","topic-azure-storage"],"categories":["Agent-Skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-external-attack-surface-management","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add MicrosoftDocs/Agent-Skills","source_repo":"https://github.com/MicrosoftDocs/Agent-Skills","install_from":"skills.sh"}},"qualityScore":"0.698","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 497 github stars · SKILL.md body (3,915 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-04-22T06:53:32.409Z","embedding":null,"createdAt":"2026-04-18T21:59:03.081Z","updatedAt":"2026-04-22T06:53:32.409Z","lastSeenAt":"2026-04-22T06:53:32.409Z","tsv":"'/en-us/azure/external-attack-surface-management/asn-asset-filters':325 '/en-us/azure/external-attack-surface-management/contact-asset-filters':336 '/en-us/azure/external-attack-surface-management/data-connections':441 '/en-us/azure/external-attack-surface-management/domain-asset-filters':347 '/en-us/azure/external-attack-surface-management/host-asset-filters':358 '/en-us/azure/external-attack-surface-management/inventory-filters':369 '/en-us/azure/external-attack-surface-management/ip-address-asset-filters':380 '/en-us/azure/external-attack-surface-management/ip-block-asset-filters':391 '/en-us/azure/external-attack-surface-management/page-asset-filters':402 '/en-us/azure/external-attack-surface-management/policy-engine':412 '/en-us/azure/external-attack-surface-management/ssl-certificate-asset-filters':423 '/en-us/azure/external-attack-surface-management/understanding-billable-assets':311 '/microsoftdocs/mcp/blob/main/readme.md)':168 '3':139 'accept':207 'access':173 'address':372 'adx':438 'affect':237 'agent':88,132,191,205 'analysi':296 'analyt':35,284,436 'appli':337,348,392 'asn':256,316 'asset':28,232,235,251,280,307,317,328,339,350,373,384,394,416 'attack':4,12,46,58 'autom':265,408 'avail':158 'azur':2,10,44,56,286 'azure-external-attack-surface-manag':1 'bill':41,225,304 'billabl':231,306 'block':383 'capabl':80 'categori':91,99,115,211,213 'cert':260 'certif':415 'code':22,67,268,425 'combin':70 'configur':19,64,241,262,273,312,403,429 'connect':290,433 'contact':258,327 'content':75,177 'cost':238 'count':228,236,308 'cover':61 'data':37,281,287,293,432 'defend':223,274,302,320,331,342,353,360,376,387,397,404,419,430 'descript':215 'develop':15 'discoveri':278 'doc':183 'document':78,176 'domain':253,338 'e.g':103,119 'easm':27,224,248,275,303,321,332,343,354,361,377,388,398,405,420,431 'engin':264,407 'estim':40 'expert':7,53 'explain':221 'explor':38,288 'export':32,277 'extern':3,11,45,57 'fallback':195 'fetch':79,175,184,197 'file':109,117,124,129 'filter':245,318,329,340,351,363,374,385,395,417 'github.com':167 'github.com/microsoftdocs/mcp/blob/main/readme.md)':166 'guid':165 'guidanc':54 'host':254,349 'import':86,130 'includ':16,289 'index':92,212 'instal':162,164 'integr':21,66,267,424 'inventori':249,322,333,344,355,362,399 'ip':371,382 'ips/blocks':255 'knowledg':8 'l120':106 'l31':219 'l31-l35':218 'l35':105,220 'l35-l120':104 'l36':243 'l36-l49':242 'l49':244 'l50':271 'l50-l53':270 'l53':272 'latest':147 'learn':190,204 'learn-agent-skil':189,203 'learn.microsoft.com':310,324,335,346,357,368,379,390,401,411,422,440 'learn.microsoft.com/en-us/azure/external-attack-surface-management/asn-asset-filters':323 'learn.microsoft.com/en-us/azure/external-attack-surface-management/contact-asset-filters':334 'learn.microsoft.com/en-us/azure/external-attack-surface-management/data-connections':439 'learn.microsoft.com/en-us/azure/external-attack-surface-management/domain-asset-filters':345 'learn.microsoft.com/en-us/azure/external-attack-surface-management/host-asset-filters':356 'learn.microsoft.com/en-us/azure/external-attack-surface-management/inventory-filters':367 'learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-address-asset-filters':378 'learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-block-asset-filters':389 'learn.microsoft.com/en-us/azure/external-attack-surface-management/page-asset-filters':400 'learn.microsoft.com/en-us/azure/external-attack-surface-management/policy-engine':410 'learn.microsoft.com/en-us/azure/external-attack-surface-management/ssl-certificate-asset-filters':421 'learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-billable-assets':309 'limit':17,62,216,297 'line':101,113,214 'link':118,127 'local':71 'locat':95 'log':34,283,435 'manag':6,14,48,60 'markdown':194,210 'mcp':153,180 'metadata.generated':134 'microsoft':182 'microsoftdoc':154,181 'month':140 'network':172 'old':141 'oth':43 'page':257,393 'pattern':23,68,269,426 'polici':30,263,406 'prefer':178 'provid':52 'pull':145 'queri':26,186,200,247,366 'quick':73 'quick-refer':72 'quota':18,63,217,240,298 'rang':102 'read':108,123 'refer':74,128 'relev':96 'remot':77 'repositori':151 'requir':171 'return':193,209 'rule':31,266,409 'save':365 'section':97 'security.md':120,121 'set':29 'setup':291 'skill':49,51,85,170,192,206 'skill-azure-external-attack-surface-management' 'source-microsoftdocs' 'specifi':112 'ssl':259,414 'string':187,201 'suggest':142,159 'surfac':5,13,47,59 'text/markdown':208 'tool':155 'topic':299,313,427 'topic-agent' 'topic-agent-skills' 'topic-agentic-skills' 'topic-agentskill' 'topic-ai-agents' 'topic-ai-coding' 'topic-azure' 'topic-azure-functions' 'topic-azure-kubernetes-service' 'topic-azure-openai' 'topic-azure-sql-database' 'topic-azure-storage' 'type':252 'understand':301 'url':300,314,428 'usag':294 'use':24,83,89,107,122,179,196,315,326,359,370,381,413 'user':144,161 'version':148 'webpag':198 'work':226","prices":[{"id":"5ce25997-4871-4c2c-94a8-55a85af1046f","listingId":"3c7e8bf0-4800-4ed2-973d-0ca74e352fb6","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"MicrosoftDocs","category":"Agent-Skills","install_from":"skills.sh"},"createdAt":"2026-04-18T21:59:03.081Z"}],"sources":[{"listingId":"3c7e8bf0-4800-4ed2-973d-0ca74e352fb6","source":"github","sourceId":"MicrosoftDocs/Agent-Skills/azure-external-attack-surface-management","sourceUrl":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-external-attack-surface-management","isPrimary":false,"firstSeenAt":"2026-04-18T21:59:03.081Z","lastSeenAt":"2026-04-22T06:53:32.409Z"}],"details":{"listingId":"3c7e8bf0-4800-4ed2-973d-0ca74e352fb6","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"MicrosoftDocs","slug":"azure-external-attack-surface-management","github":{"repo":"MicrosoftDocs/Agent-Skills","stars":497,"topics":["agent","agent-skills","agentic-skills","agentskill","ai","ai-agents","ai-coding","azure","azure-functions","azure-kubernetes-service","azure-openai","azure-sql-database","azure-storage","azure-virtual-machine","claude-code","github-copilot","microsoft-learn","openai-codex","skills"],"license":"cc-by-4.0","html_url":"https://github.com/MicrosoftDocs/Agent-Skills","pushed_at":"2026-04-22T01:37:27Z","description":"Curated Agent Skills for Microsoft & Azure – giving AI coding assistants structured, real-time expertise from Microsoft Learn docs.","skill_md_sha":"00bb7fbf90ddaf020af029150780f5093af50745","skill_md_path":"skills/azure-external-attack-surface-management/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-external-attack-surface-management"},"layout":"multi","source":"github","category":"Agent-Skills","frontmatter":{"name":"azure-external-attack-surface-management","description":"Expert knowledge for Azure External Attack Surface Management development including limits & quotas, configuration, and integrations & coding patterns. Use when querying EASM assets, setting policy rules, exporting to Log Analytics or Data Explorer, or estimating billing, and other Azure External Attack Surface Management related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel), Azure Firewall (use azure-firewall).","compatibility":"Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation."},"skills_sh_url":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-external-attack-surface-management"},"updatedAt":"2026-04-22T06:53:32.409Z"}}