Implementing network traffic baselining

Skill Mikaru0Mystic/sectinel/arsenal/Anthropic-Cybersecurity-Skills/skills/implementing-network-traffic-baselining

Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any agentskills.io agent. Mapped to OWASP, MITRE ATT&CK, NIST CSF, D3FEND, ATLAS.

Install

npx -y skills add Mikaru0Mystic/sectinel --skill implementing-network-traffic-baselining

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Build network traffic baselines from NetFlow/IPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic pattern profiling

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.2 KB, as published. Nobody here has run it

Implementing Network Traffic Baselining

Overview

Network traffic baselining establishes normal communication patterns by analyzing historical NetFlow/IPFIX data to create statistical profiles of expected behavior. This skill uses Python pandas to compute hourly and daily traffic distributions, per-host byte/packet counts, protocol ratios, and top-N talker profiles. Anomalies are detected using z-score thresholds and IQR (interquartile range) outlier methods, enabling SOC analysts to identify deviations such as data exfiltration spikes, beaconing patterns, and unusual port usage.

When to Use

When deploying or configuring implementing network traffic baselining capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

NetFlow v5/v9 or IPFIX flow data exported as CSV or JSON
Python 3.8+ with pandas and numpy libraries
Historical flow data (minimum 7 days recommended for baseline)

Steps

Ingest NetFlow/IPFIX records from CSV or JSON exports
Compute hourly and daily traffic volume distributions (bytes, packets, flows)
Build per-source-IP baseline profiles with mean, median, standard deviation
Calculate protocol and port distribution baselines
Apply z-score anomaly detection to identify statistical outliers
Flag flows exceeding IQR-based thresholds as potential anomalies
Generate baseline report with anomaly alerts

Expected Output

JSON report containing traffic baselines (hourly/daily profiles), per-host statistics, detected anomalies with z-scores, and top talker rankings with deviation indicators.