SKILL

Implementing Network Traffic Baselining

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling

Published by @mukul975·from mukul975/Anthropic-Cybersecurity-Skills·0 agent reads / 30d·0 saves·

Implementing Network Traffic Baselining

Overview

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

When to Use

  • When deploying or configuring implementing network traffic baselining capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • NetFlow v5/v9 or IPFIX flow data exported as CSV or JSON
  • Python 3.8+ with pandas and numpy libraries
  • Historical flow data (minimum 7 days recommended for baseline)

Steps

  1. Ingest NetFlow/IPFIX records from CSV or JSON exports
  2. Compute hourly and daily traffic volume distributions (bytes, packets, flows)
  3. Build per-source-IP baseline profiles with mean, median, standard deviation
  4. Calculate protocol and port distribution baselines
  5. Apply z-score anomaly detection to identify statistical outliers
  6. Flag flows exceeding IQR-based thresholds as potential anomalies
  7. Generate baseline report with anomaly alerts

Expected Output

JSON report containing traffic baselines (hourly/daily profiles), per-host statistics, detected anomalies with z-scores, and top talker rankings with deviation indicators.

Bundled with this artifact

5 files

Reference files that ship alongside this artifact. Agents pull these in only when the task needs them.

More on the bench

SKILL▲0

Deobfuscating JavaScript Malware

Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.

mukul975
cybersecurity-soc
⊙ 2
SKILL▲0

Isms Audit Expert

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.

Alireza Rezvani
compliance+2
⊙ 1
SKILL▲0

Devsecops Ssdlc Appsec Cursor Rule

Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.

cybersecurity-soc+1
⊙ 0