<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing ICS Incident Response — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ics-incident-response.

## Tools

### `tcpdump`

Packet capture for network evidence preservation.

**Usage:**
```bash
tcpdump -i eth1 -w /evidence/capture.pcap
```

**Key Flags:**
  - `-c`: limit packet count
  - `-G`: rotate file every N seconds
  - `-W`: limit number of rotated files

---

### `snap7` (Python)

Siemens S7 PLC state capture for evidence collection.

**Usage:**
```python
import snap7
client = snap7.client.Client()
client.connect('10.0.0.1', 0, 1)
state = client.get_cpu_state()
```

**Key Methods:**
  - `get_cpu_state()`: read CPU run/stop status
  - `list_blocks()`: enumerate program blocks
  - `full_upload()`: extract block data

---

### `wevtutil`

Windows event log export for HMI forensics.

**Usage:**
```powershell
wevtutil epl Security /evidence/security.evtx
```

---

### `WinPMEM`

Memory acquisition tool for Windows-based HMI workstations.

**Usage:**
```powershell
winpmem_mini_x64.exe /evidence/memory.raw
```

---

## Integration Notes

- ALWAYS collect volatile evidence (network, memory) before containment actions
- PLC state capture is non-disruptive — read operations do not affect process
- Coordinate all containment with OT engineering — safety takes precedence
- Maintain chain of custody documentation for all evidence

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82 Rev 3 §7: ICS Incident Response
