<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing ICS Anomaly Detection — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ics-anomaly-detection.

## Tools

### `zeek`

Network analysis framework for ICS traffic baselining and anomaly detection.

**Usage:**
```bash
zeek -r <pcap> local modbus dnp3
```

**Key Outputs:**
  - `conn.log`: connection records with timing
  - `modbus.log`: parsed Modbus transactions
  - `dnp3.log`: parsed DNP3 transactions

---

### `suricata`

IDS/IPS with threshold-based anomaly detection for ICS protocols.

**Usage:**
```bash
suricata -r <pcap> -S ics_anomaly.rules -l /tmp/output/
```

**Key Config:**
  - `threshold.yaml`: rate limiting and anomaly thresholds
  - `app-layer.protocols.modbus.enabled`: enable Modbus parser

---

### `tcpdump`

Packet capture for long-term baseline collection.

**Usage:**
```bash
tcpdump -i eth1 -w baseline.pcap -G 86400 -W 7
```

**Key Flags:**
  - `-G 86400`: rotate every 24h
  - `-W 7`: keep 7 files (1 week baseline)

---

## Integration Notes

- Baseline requires minimum 7 days of operational data for cycle coverage
- Statistical thresholds should be tuned per process variable
- Integrate alerts with SIEM for correlation with host events

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- IEC 62443-3-3 SR 6.2: Continuous Monitoring
