<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing ICS Network Monitoring — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ics-network-monitoring.

## Tools

### `zeek`

Network analysis framework for continuous ICS protocol monitoring.

**Usage:**
```bash
zeekctl deploy
zeekctl status
```

**Key Commands:**
  - `deploy`: start Zeek with current configuration
  - `status`: check worker status
  - `diag`: diagnostics for troubleshooting

**Key Config Files:**
  - `/etc/zeek/local.zeek`: loaded scripts
  - `/etc/zeek/node.cfg`: interface and cluster config
  - `/etc/zeek/networks.cfg`: local network definitions

---

### `suricata`

IDS/IPS engine with ICS protocol support.

**Usage:**
```bash
suricata -c /etc/suricata/suricata.yaml -i eth1
```

**Key Flags:**
  - `-T`: test configuration
  - `-S`: specify rule file
  - `--set`: override config values

**Key Commands:**
  - `suricatasc -c reload-rules`: hot reload rules
  - `suricata-update`: update rulesets

---

### `filebeat`

Log shipper for Zeek and Suricata integration with SIEM.

**Usage:**
```bash
filebeat modules enable zeek suricata
filebeat test config
```

---

### `tcpdump`

Raw packet capture for sensor validation.

**Usage:**
```bash
tcpdump -i eth1 -c 100 -nn
```

---

## Integration Notes

- Deploy TAPs (not SPAN) where possible — TAPs are passive and cannot drop packets
- Zeek and Suricata complement each other: Zeek for logs, Suricata for alerts
- Size storage for 90+ days of Zeek logs at OT traffic rates
- Monitor sensor health — dropped packets indicate performance issues

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82 Rev 3 §6.3: OT Network Monitoring
