About

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-network-traffic-baselining/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-network-traffic-baselining. Copyright stays with the author (Apache-2.0).

Implementing Network Traffic Baselining

Name: implementing-network-traffic-baselining
Author: mukul975

Overview

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

When to Use

When deploying or configuring implementing network traffic baselining capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

NetFlow v5/v9 or IPFIX flow data exported as CSV or JSON
Python 3.8+ with pandas and numpy libraries
Historical flow data (minimum 7 days recommended for baseline)

Steps

Ingest NetFlow/IPFIX records from CSV or JSON exports
Compute hourly and daily traffic volume distributions (bytes, packets, flows)
Build per-source-IP baseline profiles with mean, median, standard deviation
Calculate protocol and port distribution baselines
Apply z-score anomaly detection to identify statistical outliers
Flag flows exceeding IQR-based thresholds as potential anomalies
Generate baseline report with anomaly alerts

Expected Output

JSON report containing traffic baselines (hourly/daily profiles), per-host statistics, detected anomalies with z-scores, and top talker rankings with deviation indicators.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-net-5fc040/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-implementing-net-5fc040.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-implementing-net-5fc040",
  "kind": "skill",
  "name": "implementing-network-traffic-baselining",
  "description": "Builds network traffic baselines from NetFlow/IPFIX CSV or JSON exports using Python pandas, computing hourly/daily volume distributions, per-host and protocol/port statistics, and top-talker profiles, then flags outliers via z-score and IQR anomaly detection. Use when a SOC analyst needs to establish normal traffic patterns and surface deviations such as data exfiltration spikes, beaconing, or unusual port usage from historical flow data.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "data_analysis",
      "coding"
    ],
    "tags": [
      "skill-md",
      "netflow",
      "ipfix",
      "traffic-analysis",
      "baselining",
      "anomaly-detection",
      "pandas",
      "network-monitoring",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Builds network traffic baselines from NetFlow/IPFIX CSV or JSON exports using Python pandas, computing hourly/daily volume distributions, per-host and protocol/port statistics, and top-talker profiles, then flags outliers via z-score and IQR anomaly detection. Use when a SOC analyst needs to establish normal traffic patterns and surface deviations such as data exfiltration spikes, beaconing, or unusual port usage from historical flow data."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/implementing-network-traffic-baselining/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-network-traffic-baselining/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-network-traffic-baselining/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing Network Traffic Baselining\n\n## Overview\n\nNetwork traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.\n\n\n## Wh",
  "cost": {
    "context_tokens": 443
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-net-5fc040/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.