ot-firewall-rule-reviewlisted

## When to Use - Periodic review of firewall rule sets protecting OT zones. - Before or after a segmentation redesign. - Investigating traffic observed in a Purdue level it should not reach. - Change review for a new conduit request. ## Prerequisites - Rule export from each firewall. The `references/questionnaire.md` file defines the required export fields. - Network to Purdue level mapping for the site. One row per subnet: network, Purdue level. - Firewall platform docs for export format: Tofino, Hirschmann EAGLE, Cisco IOS/ASA, FortiGate, Palo Alto. - Credentials: read-only firewall admin or an operator-provided export. - Authorization: firewall owner sign-off. Config review is passive. - Upstream skills: `passive-ot-network-discovery` for observed flow baselines. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Parses exported rule files. Sends no packets. Safe to run during normal operations. ## Workflow 1. Collect rule exports from every firewall on the OT boundary. Required fields per rule: name, source, destination, protocol, port, action, justification, change reference, last hit counter. 2. Map each site subnet to its Purdue level. Store as `purdue-map.csv` with columns: network, level. 3. Parse and flag: `python3 scripts/parse_firewall_config.py --rules <rules.csv> --purdue-map purdue-map.csv --out firewall-rule-review.md` The parser flags: - any-any rules. Source and destination both unconstrai