Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.
Quickly understand datasets, identify patterns, and generate insights
Example: Analyze CSV with 100K rows, identify outliers, visualize correlations, suggest hypotheses
Reduce EDA time from hours to minutes, uncover insights faster
Write scripts to clean messy data, handle missing values, normalize formats
Example: Generate Python/SQL to fix date formats, impute missing values, remove duplicates
Automate 80% of data preprocessing work
Perform hypothesis testing, regression, and statistical modeling
Example: Run A/B test analysis, calculate confidence intervals, interpret p-values
Get statistically sound analysis without PhD in statistics
Create charts, dashboards, and visual reports
Example: Generate matplotlib/seaborn code for time series plots, distribution charts, heatmaps
Build presentation-ready visualizations 3x faster
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-network-flow-data-with-netflowCompatible with
Supported agents
| name | analyzing-network-flow-data-with-netflow |
| description | Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns. |
| domain | cybersecurity |
| subdomain | network-security |
| tags | - analyzing - network - flow - data |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | - PR.IR-01 - DE.CM-01 - ID.AM-03 - PR.DS-02 |
pip install netflowpython -m netflow.collector -p 9995netflow.parse_packet().python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionanalyzing-network-flow-data-with-netflowExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-network-flow-data-with-netflowFetches analyzing-network-flow-data-with-netflow from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/analyzing-network-flow-data-with-netflow
Restart Cursor to activate analyzing-network-flow-data-with-netflow. Access via /analyzing-network-flow-data-with-netflowin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Time estimate: 20-40 minutes to set up and run first analysis
Prerequisites
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use for exploratory data analysis, data cleaning, statistical testing, visualization prototyping, and learning new analysis techniques. Best for initial exploration and rapid insights.
✗ Avoid when
Avoid for mission-critical financial analysis, medical research requiring regulatory compliance, production ML models, or when deep statistical expertise is required for nuanced interpretation.
performing-thick-client-application-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · performing-thick-client-application-penetration-test · same repo
implementing-soar-playbook-with-palo-alto-xsoar
mukul975/Anthropic-Cybersecurity-Skills · implementing-soar-playbook-with-palo-alto-xsoar · same repo
scanning-docker-images-with-trivy
mukul975/Anthropic-Cybersecurity-Skills · scanning-docker-images-with-trivy · same repo
analyzing-network-traffic-for-incidents
mukul975/Anthropic-Cybersecurity-Skills · analyzing-network-traffic-for-incidents · same repo
building-red-team-c2-infrastructure-with-havoc
mukul975/Anthropic-Cybersecurity-Skills · building-red-team-c2-infrastructure-with-havoc · same repo
exploiting-sql-injection-with-sqlmap
mukul975/Anthropic-Cybersecurity-Skills · exploiting-sql-injection-with-sqlmap · same repo
analyzing-network-flow-data-with-netflow fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Solid pick for teams standardizing on skills: analyzing-network-flow-data-with-netflow is focused, and the summary matches what you get after install.
We added analyzing-network-flow-data-with-netflow from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
Keeps context tight: analyzing-network-flow-data-with-netflow is the kind of skill you can hand to a new teammate without a long onboarding doc.
analyzing-network-flow-data-with-netflow fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
analyzing-network-flow-data-with-netflow is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Keeps context tight: analyzing-network-flow-data-with-netflow is the kind of skill you can hand to a new teammate without a long onboarding doc.
analyzing-network-flow-data-with-netflow is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
We added analyzing-network-flow-data-with-netflow from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
Registry listing for analyzing-network-flow-data-with-netflow matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 33