ICS Anomaly Detection
Lets the agent set up and run anomaly detection on industrial (OT/SCADA) network traffic and flag deviations.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill gives an AI agent a playbook for watching industrial control networks, such as those running factory equipment, power or water systems. It explains how to learn what normal traffic looks like between controllers and field devices (using industrial protocols like Modbus, DNP3 and OPC UA), then uses machine learning to flag unusual timing, new devices or odd commands. The skill's included Python code is a partial, unfinished example: the detector class is cut off mid-method, and a separate script attempts to query Modbus devices directly over the network.
Great for
- OT security engineers who need behavior-based monitoring on networks without intrusion detection
- Analysts who want to review or triage alerts from Nozomi Guardian or Dragos Platform
- Developers building Python tooling for industrial network baselining
Skip it if
- Production OT environments without expert review: the code is incomplete and the skill itself says it must not replace safety systems (SIS), and active scanning of live control devices can disrupt processes
- Detecting known exploits or signature-based attacks, which the skill directs elsewhere
- IT-only networks with no industrial protocols, where the skill is not designed to help
Try asking
- “Build a communication baseline from our captured Modbus pcap flow records and train an Isolation Forest model”
- “Investigate this Dragos alert and check whether the DNP3 function codes match the normal pattern”
- “Scan the Modbus device at 192.168.10.5 and report its holding registers and device identification”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
detecting-anomalies-in-industrial-control-systems.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip detecting-anomalies-in-industrial-control-systems.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip detecting-anomalies-in-industrial-control-systems.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the baseline and training steps only on captured traffic from passive sensors; avoid pointing the scan script at live production PLCs without change-control approval and a test environment
- Review the included code before running it, since it is incomplete and the device script performs live read requests over TCP port 502 by default
- Provide your normal operating schedule (shift changes, batch cycles, maintenance windows) so the agent can tune thresholds and reduce false alarms
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.