Analyzing Network Flow Data
FreeDetect anomalies in network flow data using NetFlow.
Free · Opens the source repo
What Analyzing Network Flow Data does
The Analyzing Network Flow Data skill is designed for security professionals who need to analyze network traffic using NetFlow v9 and IPFIX protocols. This skill leverages the Python netflow library to decode flow records, allowing users to identify potential security threats such as volumetric anomalies, port scanning, data exfiltration, and command-and-control (C2) beaconing patterns. By establishing traffic baselines and applying statistical analysis, it helps users detect abnormal behaviors in network flows.
To utilize this skill, users must have a foundational understanding of network security concepts and the appropriate tools. The skill requires a Python environment with the necessary dependencies installed. Once set up, users can collect NetFlow or IPFIX data from routers and parse this data to conduct detailed analyses. The skill includes specific methods to identify different types of anomalies, such as high outbound byte counts to unusual destinations or periodic connections that may indicate C2 activity.
This skill is particularly useful for Security Operations Center (SOC) analysts who are tasked with threat hunting and building detection rules. It provides structured procedures for analyzing network flow data, which can be crucial during security incident investigations. Users can also validate their security monitoring coverage against known attack techniques, ensuring that their defenses are robust against potential threats.
Overall, this skill is an essential tool for those looking to enhance their network security posture through detailed analysis of flow data, helping to proactively identify and mitigate risks before they escalate into significant issues.
When to use it
Use this skill when investigating security incidents that require detailed analysis of network flow data or when developing detection rules for threat hunting.
When not to use it
This skill may not be suitable for users without a basic understanding of network security concepts or those looking for a general-purpose traffic analysis tool.
What you can build with it
Investigating a Security Incident
Use this skill to analyze network flow data during a security incident, helping to identify potential threats.
Building Detection Rules
Develop detection rules based on historical flow data to enhance your organization's threat hunting capabilities.
Validating Security Monitoring Coverage
Ensure that your security monitoring tools are effectively covering known attack techniques by analyzing network flow data.
How to install Analyzing Network Flow Data
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-network-flow-data-with-netflow --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Network Flow Data with Netflow
When to Use
- When investigating security incidents that require analyzing network flow data with netflow
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with network security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install netflow - Collect NetFlow/IPFIX data from routers or use the built-in collector:
python -m netflow.collector -p 9995 - Parse captured flow data using
netflow.parse_packet(). - Analyze flows for:
- Port scanning: single source to many destinations on same port
- Data exfiltration: high byte-count outbound flows to unusual destinations
- C2 beaconing: periodic connections with consistent intervals
- Volumetric anomalies: traffic spikes beyond baseline thresholds
- Generate a prioritized findings report.
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json
Examples
Parse NetFlow v9 Packet
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)
Frequently asked questions about Analyzing Network Flow Data
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.