How do I install the Azure External Attack Surface Management skill?

Run npx skillmds@latest add luokai0/azure-external-attack-surface-management in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Azure External Attack Surface Management safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Azure External Attack Surface Management?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Azure External Attack Surface Management free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Azure External Attack Surface Management?

luokai0 (@luokai0) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Azure External Attack Surface Management by luokai0

Name: Azure External Attack Surface Management
Rating: 4.2 (5 reviews)
Author: luokai0

Azure External Attack Surface Management

Expert knowledge for Azure External Attack Surface Management development including limits & quotas, configuration, and integrations & coding patterns. Use when querying EASM assets, setting policy rules, exporting to Log Analytics or Data Explorer, or estimating billing, and other Azure External Attack Surface Management related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel), Azure Firewall (use azure-firewall).

luokai0 Updated Sep 8, 2026 10 repo stars

File contents

Azure External Attack Surface Management Skill

This skill provides expert guidance for Azure External Attack Surface Management. Covers limits & quotas, configuration, and integrations & coding patterns. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Limits & Quotas	L31-L35	Explains how Defender EASM billing works, what counts as a billable asset, and how asset counts affect costs and quotas.
Configuration	L36-L49	Filtering and querying EASM inventory by asset type (domains, hosts, IPs/blocks, ASNs, pages, contacts, SSL certs) and configuring policy engine automation rules.
Integrations & Coding Patterns	L50-L53	Configuring Defender EASM to export discovery and asset data into Log Analytics and Azure Data Explorer, including connection setup and data usage for analysis.

Limits & Quotas

Topic	URL
Understand Defender EASM billing and billable asset counts	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-billable-assets

Configuration

Topic	URL
Use ASN asset filters in Defender EASM inventory	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/asn-asset-filters
Use contact asset filters in Defender EASM inventory	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/contact-asset-filters
Apply domain asset filters in Defender EASM inventory	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/domain-asset-filters
Apply host asset filters in Defender EASM inventory	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/host-asset-filters
Use Defender EASM inventory filters and saved queries	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/inventory-filters
Use IP address asset filters in Defender EASM	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-address-asset-filters
Use IP block asset filters in Defender EASM	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-block-asset-filters
Apply page asset filters in Defender EASM inventory	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/page-asset-filters
Configure Defender EASM policy engine automation rules	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/policy-engine
Use SSL certificate asset filters in Defender EASM	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ssl-certificate-asset-filters

Integrations & Coding Patterns

Topic	URL
Configure Defender EASM data connections to Log Analytics and ADX	https://learn.microsoft.com/en-us/azure/external-attack-surface-management/data-connections

---name: azure-external-attack-surface-managementdescription: Expert knowledge for Azure External Attack Surface Management development including limits & quotas, configuration, and integrations & coding patterns. Use when querying EASM assets, setting policy rules, exporting to Log Analytics or Data Explorer, or estimating billing, and other Azure External Attack Surface Management related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel), Azure Firewall (use azure-firewall).---# Azure External Attack Surface Management SkillThis skill provides expert guidance for Azure External Attack Surface Management. Covers limits & quotas, configuration, and integrations & coding patterns. It combines local quick-reference content with remote documentation fetching capabilities.## How to Use This Skill> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)This skill requires **network access** to fetch documentation content:- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.## Category Index| Category | Lines | Description ||----------|-------|-------------|| Limits & Quotas | L31-L35 | Explains how Defender EASM billing works, what counts as a billable asset, and how asset counts affect costs and quotas. || Configuration | L36-L49 | Filtering and querying EASM inventory by asset type (domains, hosts, IPs/blocks, ASNs, pages, contacts, SSL certs) and configuring policy engine automation rules. || Integrations & Coding Patterns | L50-L53 | Configuring Defender EASM to export discovery and asset data into Log Analytics and Azure Data Explorer, including connection setup and data usage for analysis. |### Limits & Quotas| Topic | URL ||-------|-----|| Understand Defender EASM billing and billable asset counts | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-billable-assets |### Configuration| Topic | URL ||-------|-----|| Use ASN asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/asn-asset-filters || Use contact asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/contact-asset-filters || Apply domain asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/domain-asset-filters || Apply host asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/host-asset-filters || Use Defender EASM inventory filters and saved queries | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/inventory-filters || Use IP address asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-address-asset-filters || Use IP block asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ip-block-asset-filters || Apply page asset filters in Defender EASM inventory | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/page-asset-filters || Configure Defender EASM policy engine automation rules | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/policy-engine || Use SSL certificate asset filters in Defender EASM | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/ssl-certificate-asset-filters |### Integrations & Coding Patterns| Topic | URL ||-------|-----|| Configure Defender EASM data connections to Log Analytics and ADX | https://learn.microsoft.com/en-us/azure/external-attack-surface-management/data-connections |

Frequently asked questions