opc-ua-endpoint-discoverylisted

## When to Use - Mapping OPC UA endpoints before monitoring deployment. - Recording the security policy set (None, Basic128Rsa15, Basic256, Basic256Sha256) for the segment. - Investigating connections rejected with BadSecurityPolicyRejected. - Preparing an OPC UA firewall rule set. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - nmap 7.94 or newer with the `opcua-discovery` NSE script. - SPAN port or network TAP on the segment. - Credentials: anonymous or a read-only service account where the server enforces authentication. - Authorization: server owner sign-off for endpoint probes. - Upstream skills: `passive-ot-network-discovery` for the flow baseline. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Resolve the OPC UA field names for this tshark revision: `tshark -G fields | grep -i opcua | grep -iE "policy|token" | head -20` Use the resolved names in the commands below. 2. Passive flow map: `tshark -r capture.pcapng -Y "opcua" -T fields -e ip.src -e ip.dst -e tcp.dstport -E separator=, | sort -u > opcua_flows.csv` 3. Record the security policies observed in OpenSecureChannel frames. Parse the resolved policy field per source address and list the distinct values. A server seen only with the policy None is a hardening finding, not a configuration fact. 4. Probe a server that never opens