NetFlow Network Flow Analyzer
Spot port scans, exfiltration, beaconing and traffic spikes in NetFlow/IPFIX records
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can read network flow logs (summaries of who talked to whom, how much data moved, and when) exported by routers in NetFlow v9 or IPFIX format. It builds a rough baseline of normal traffic and then looks for patterns that often indicate trouble: one host scanning many ports, unusually large outbound transfers that could mean data theft, and regular timed connections that can signal malware calling home. It then writes a prioritized findings report. It is guidance plus a helper script, not a finished product, and the included script is partly a sketch.
Great for
- Security analysts or SOC staff reviewing router or firewall flow exports
- Network engineers who want a starting point for scripted traffic anomaly checks
- Students learning how NetFlow data is structured and how basic detections work
Skip it if
- Production alerting without review: the script's thresholds and statistics are simple, so it will produce false positives and miss attacks; findings need analyst validation
- Analysing networks you do not own or have no authorization to monitor, since flow records reveal user activity and may be sensitive personal data
Try asking
- “Analyze this NetFlow export for port scans, showing the source IPs and the ports they touched.”
- “Build a traffic baseline from last week's flow data and flag hosts with byte counts far above normal.”
- “Check these flow records for periodic connections that might indicate C2 beaconing and rank the findings by severity.”
- “Parse this NetFlow v9 capture and summarize the top outbound destinations by bytes sent.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-network-flow-data-with-netflow.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-network-flow-data-with-netflow.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-network-flow-data-with-netflow.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Provide a preprocessed JSON flow file or a representative sample, and check that the script's field names match your export before trusting results.
- Treat every finding as a lead to verify against other logs, and tune thresholds to your own network's normal behaviour.
- Run the analysis in a lab or on copies of data first, and review the script before executing it since it runs locally on your files.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.