comradezephyr
UserStructured OT/ICS security runbooks for AI agents. Mapped to IEC 62443, NIST SP 800-82, and MITRE ATT&CK for ICS.
Categories
Indexed Skills (42)
skill-name-in-kebab-case
One or two sentences. State WHAT this skill does and WHEN to use it. Include OT-specific trigger keywords such as "PLC", "Modbus", "historian", "Purdue". Max 1024 characters.
conduit-security-design
Design the security specification for each conduit between OT zones, covering protocol, direction, source and destination pairs, session limits, and the encryption or inspection decision. Use when hardening zone-to-zone communication paths.
dmz-architecture-for-ot
Design the DMZ between IT and OT covering service placement, data diode or firewall decisions, jump hosts, historian replication, patch staging, and vendor access termination. Use when designing or auditing the L3.5 boundary.
dnp3-anomaly-detection
Build and run DNP3 anomaly detection with Suricata and Zeek rules covering unauthorized function codes, outstation impersonation, unsolicited responses, cold restart, time sync changes, and auth bypass attempts. Use when monitoring port 20000 traffic.
dnp3-outstation-inventory
Enumerate DNP3 outstations, data link addresses, and function code use on port 20000. Use when mapping a DNP3 SCADA segment before monitoring or firewall rule work.
engineering-workstation-hardening-audit
Audit OT engineering workstations (EWS) for hardening gaps covering patch level, USB policy, application whitelisting, antivirus exclusions, shared credentials, and engineering software versions. Use when assessing the EWS estate.
ethernet-ip-device-discovery
Enumerate EtherNet/IP (CIP) devices on TCP 44818 and UDP 2222, capture identity responses, and map the CIP object model. Use when building the CIP asset list for a Rockwell or third-party CIP segment.
historian-data-flow-mapping
Map data flows between PLCs, HMIs, and historians such as OSIsoft PI, Honeywell PHD, Wonderware Historian, and Ignition. Use when auditing which sources feed each historian and confirming L3 placement.
historian-tampering-detection
Detect tampering with historian data including direct SQL writes outside the collector path, backfilled values, timestamp anomalies, retention deletion, and unapproved writer sources. Use when auditing OSIsoft PI, Wonderware, Honeywell PHD, or Ignition data integrity.
iec-62443-certification-readiness
Prepare for IEC 62443 certification across the applicable parts, covering scope definition, prerequisite designs, per-part evidence registers, gap analysis, and certification body coordination. Use when planning product or system certification.
iec-62443-gap-assessment
Assess a zone against IEC 62443-3-3 system security requirements using a structured questionnaire and document review. Use when preparing a gap register for an OT zone before remediation planning.
it-ot-convergence-risk-assessment
Assess risks from IT/OT convergence projects such as data lakes, cloud analytics, remote monitoring, and IoT sensors, producing a risk register with go or no-go criteria per path. Use when a convergence project proposes a new data or access path into OT.
modbus-anomaly-detection
Build and run Modbus TCP anomaly detection with Suricata and Zeek rules covering unauthorized write function codes, register scanning, unit ID spoofing, and out-of-hours PLC writes. Use when monitoring port 502 traffic for PLC abuse.
modbus-device-enumeration
Enumerate Modbus TCP devices, unit IDs, register maps, and allowed function codes from capture and targeted reads. Use when building a register map for a segment that carries Modbus on port 502.
nerc-cip-compliance-check
Assess a site against applicable NERC CIP standards, producing a requirement-level compliance matrix with evidence sources and gap notes. Use when preparing for a CIP audit or determining applicability for on-site generation.
nist-800-82-control-mapping
Map existing OT controls to NIST SP 800-82 Rev. 3 control families through a structured questionnaire and evidence review. Use when building a control coverage matrix for a plant or fleet.
opc-ua-endpoint-discovery
Discover OPC UA servers on port 4840 and record their endpoints and security policies. Use when mapping OPC UA flows between historians, HMIs, and controllers.
ot-asset-ownership-governance
Establish governance for OT asset ownership covering who owns each asset class, who approves changes, who reviews access, who signs off lifecycle decisions, and the escalation path for unowned assets. Use when accountability for OT assets is unclear or contested.
ot-backup-and-recovery-design
Design backup and recovery for PLCs, HMIs, and historians with per-asset-class RTO and RPO targets, offline storage and air-gap strategy, and a restore test schedule. Use when designing how OT systems recover from compromise or failure.
ot-change-management-workflow
Design a change management workflow for OT that maintains security controls, covering request fields, class-based approval gates, a security review step, mandatory rollback plans, and post-change verification. Use when designing how changes reach OT systems.
ot-firewall-rule-review
Review industrial firewall rule exports for any-any rules, overly broad conduits, missing justification, stale rules, and Purdue boundary violations. Use when auditing rule sets on Tofino, Hirschmann, Cisco IE, Fortinet, or Palo Alto in OT mode.
ot-incident-response-plan-review
Review an OT incident response plan against the NIST SP 800-61 phases and NIST SP 800-82r3 IR requirements, covering decision authority, safety gates, escalation, contacts, playbooks, and enterprise integration. Use when a plan needs review or improvement.
ot-incident-triage
Triage an OT security incident in the first hour with safety-first decision gates, classifying impact type and choosing isolate or monitor. Use when an OT alert, operator report, or enterprise SOC notification needs a response decision.
ot-lateral-movement-detection
Detect lateral movement between Purdue levels including RDP and SMB crossings, non-adjacent level flows, vendor tunnel reuse, and jump host sessions to unapproved targets. Use when monitoring the OT boundary for adversary staging.
ot-network-isolation-procedure
Isolate a compromised OT network segment with minimal process impact, covering boundary selection, process flow enumeration, operations notification, firewall or VLAN enforcement, and two-sided verification. Use when a segment must be cut from OT.
ot-network-segmentation-design
Design zone and conduit boundaries for an OT network using Purdue levels and the IEC 62443 zone model, with per-zone SL-T targets and a conduit list. Use when designing or redesigning OT network segmentation.
ot-remote-access-audit
Audit VPN configurations, jump hosts, and remote access paths into OT, including vendor tunnels, modems, MFA coverage, and session logging. Use when reviewing remote paths before an account hygiene pass.
ot-security-awareness-training-plan
Design role-based security awareness training for OT operators, engineers, and contractors, covering topics per role, delivery, frequency, assessment, and tracking. Use when designing or improving OT security training.
ot-security-program-maturity-assessment
Assess OT security program maturity against the C2M2 domains with MIL 0 through 3 per domain, producing per-domain scores, evidence, top gaps, and an improvement roadmap. Use when measuring program maturity or planning capability investment.
ot-vendor-risk-assessment
Assess security risk of OT vendors and suppliers against defined dimensions with cited evidence, incident history measures, SBOM availability, remote access model, and contract clause mapping. Use when onboarding a vendor or refreshing third-party risk.
passive-ot-network-discovery
Passively captures and analyzes OT traffic from a SPAN port or TAP to inventory PLCs, HMIs, and historians. Use when assessing an unfamiliar OT network segment where active scanning is not approved.
plc-logic-integrity-check
Compare running PLC logic against a known-good baseline using snap7 uploads, vendor compare tools, and register-level checks. Use when verifying that no unauthorized program change hit a controller.
plc-recovery-from-backup
Restore a compromised or corrupted PLC from a verified backup with a rollback plan, covering integrity verification, maintenance window confirmation, restore execution, and post-restore process verification. Use when PLC logic or configuration is untrusted.
post-incident-ot-forensics
Collect and preserve forensic evidence from OT devices after an incident, ranking sources by volatility and process risk, hashing every artifact, and building the incident timeline. Use after containment when the evidence must be captured without disrupting operations.
profinet-anomaly-detection
Build and run Layer 2 PROFINET detection with a Zeek policy covering DCP Set commands, duplicate device names, ARP spoofing, cycle time disruption, and missing RT frames. Use when monitoring PROFINET controller and IO device traffic.
profinet-device-inventory
Discover and fingerprint PROFINET devices on Layer 2 through DCP frames, then verify them with the profinet-cm-lookup NSE script. Use when a PROFINET island has no controller device list.
purdue-model-zone-conduit-audit
Audit zone and conduit definitions against the IEC 62443 zones and conduits model and Purdue level boundaries, using diagrams and captured flow data. Use when validating segmentation before a remediation program.
ransomware-response-in-ot
Respond to ransomware in an OT environment without shutting down production, isolating only affected systems and preserving controller and historian operations. Use when ransomware indicators appear on SCADA, HMI, historian, or Purdue L3 systems.
safe-remote-access-architecture
Design remote access for vendors and engineers into OT with mandatory MFA, session recording, time-limited grants, jump host brokering, and a two-person break-glass procedure. Use when designing or redesigning how external parties reach OT systems.
safety-instrumented-system-anomaly-detection
Detect anomalies on safety instrumented systems including bypass activation, override set, trip setpoint modification, sensor disagreement, and SIS to BPCS writes. Use when monitoring Triconex, HIMA, ProSafe, Safety Manager, or DeltaV SIS platforms.
scada-hmi-incident-containment
Contain a compromised SCADA HMI without disrupting process control by isolating it at the firewall, preserving session logs, and switching operators to a backup HMI path. Use when an HMI shows compromise indicators or receives untrusted input.
stuxnet-style-attack-detection
Detect logic tampering, sensor spoofing, and EWS-driven PLC writes consistent with Stuxnet-style attacks. Use when hunting for covert PLC modification where network controls show nothing and process behavior does not match operator intent.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.