Analyzing Network Flow Data
FreeDetect anomalies in network flow data using NetFlow.
Free · Opens the source repo
What Analyzing Network Flow Data does
The Analyzing Network Flow Data skill is designed for security professionals who need to analyze network traffic using NetFlow v9 and IPFIX protocols. This skill leverages the Python netflow library to decode flow records, allowing users to identify potential security threats such as volumetric anomalies, port scanning, data exfiltration, and command-and-control (C2) beaconing patterns. By establishing traffic baselines and applying statistical analysis, it helps users detect abnormal behaviors in network flows.
To utilize this skill, users must have a foundational understanding of network security concepts and the appropriate tools. The skill requires a Python environment with the necessary dependencies installed. Once set up, users can collect NetFlow or IPFIX data from routers and parse this data to conduct detailed analyses. The skill includes specific methods to identify different types of anomalies, such as high outbound byte counts to unusual destinations or periodic connections that may indicate C2 activity.
This skill is particularly useful for Security Operations Center (SOC) analysts who are tasked with threat hunting and building detection rules. It provides structured procedures for analyzing network flow data, which can be crucial during security incident investigations. Users can also validate their security monitoring coverage against known attack techniques, ensuring that their defenses are robust against potential threats.
Overall, this skill is an essential tool for those looking to enhance their network security posture through detailed analysis of flow data, helping to proactively identify and mitigate risks before they escalate into significant issues.
When to use it
Use this skill when investigating security incidents that require detailed analysis of network flow data or when developing detection rules for threat hunting.
When not to use it
This skill may not be suitable for users without a basic understanding of network security concepts or those looking for a general-purpose traffic analysis tool.
What you can build with it
Investigating a Security Incident
Use this skill to analyze network flow data during a security incident, helping to identify potential threats.
Building Detection Rules
Develop detection rules based on historical flow data to enhance your organization's threat hunting capabilities.
Validating Security Monitoring Coverage
Ensure that your security monitoring tools are effectively covering known attack techniques by analyzing network flow data.
How to install Analyzing Network Flow Data
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-network-flow-data-with-netflow --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Network Flow Data with Netflow
When to Use
- When investigating security incidents that require analyzing network flow data with netflow
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with network security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install netflow - Collect NetFlow/IPFIX data from routers or use the built-in collector:
python -m netflow.collector -p 9995 - Parse captured flow data using
netflow.parse_packet(). - Analyze flows for:
- Port scanning: single source to many destinations on same port
- Data exfiltration: high byte-count outbound flows to unusual destinations
- C2 beaconing: periodic connections with consistent intervals
- Volumetric anomalies: traffic spikes beyond baseline thresholds
- Generate a prioritized findings report.
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json
Examples
Parse NetFlow v9 Packet
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)
Frequently asked questions about Analyzing Network Flow Data
Similar skills
Security Triage
Efficiently manage OpenClaw security advisories.
OSS Security Forensics
Investigate open-source supply chain attacks effectively.
Security Advisory Management
Streamline your response to GitHub Security Advisories.
Bumblebee Security Scan
Detect compromised packages on macOS/Linux.
Incident Runbook Templates
Streamline your incident response with structured templates.
Memory Forensics
Analyze memory dumps for incident response and malware detection.