Introducing OT Security Agent Skills: Bringing AI-Assisted Forensics to Industrial Cybersecurity
An open-source collection of eight reusable AI Agent Skills for ICS/OT security investigations.
Industrial cybersecurity investigations require more than identifying suspicious network traffic. Analysts must understand industrial protocols, interpret control commands, correlate evidence, and assess potential operational consequences.
With the growing capabilities of AI agents, I wanted to explore a practical question:
Can we equip AI agents with reusable, specialized skills to support ICS/OT cybersecurity investigations?
This led me to develop OT Security Agent Skills, an open-source project combining Python forensic tools, industrial protocol knowledge, and structured instructions for AI agents.
What’s Included?
The initial release includes eight specialized AI Agent Skills:
1. Modbus Forensics — Analyze PLC register and coil operations.
2. BACnet Forensics — Investigate building automation communications.
3. Siemens S7 Forensics — Examine PLC communications and control operations.
4. IEC-104 Forensics — Analyze SCADA telemetry and control commands.
5. OT Application Forensics — Investigate Node-RED, Grafana, InfluxDB, and MariaDB artifacts.
6. OT Evidence Normalizer — Transform forensic findings into structured evidence.
7. OT Process Analysis — Assess potential operational consequences.
8. Attack Chain Reconstruction — Reconstruct chronological IT-to-OT incident timelines.
Get Sulaiman Alhasawi’s stories in your inbox
Join Medium for free to get updates from this writer.
Each skill includes a SKILL.md file for AI-agent instructions, Python analysis tools, technical references, and automated tests.
Each skill contains a SKILL.md file that guides compatible AI agents, alongside Python scripts, technical references, and automated tests.
The tools are designed for passive, offline analysis without interacting with live industrial controllers.
From Individual Tools to Agentic Investigations
The broader vision is to create an investigation workflow where an AI agent can select appropriate capabilities based on the evidence.
For example, an analyst investigating suspicious PLC communications could use a protocol forensic skill to extract relevant operations, normalize those findings, and pass them to process-analysis and attack-chain reconstruction tools.
The goal is to move from isolated scripts toward reusable, evidence-driven investigation capabilities.
Currently, the skills provide standalone analysis and selected cross-skill integrations. Fully autonomous investigation and orchestration remain future development goals.
Why Open Source?
Industrial cybersecurity benefits from shared knowledge, reproducible research, and collaboration.
By publishing these skills, I hope to encourage researchers, incident responders, and OT engineers to experiment with AI-assisted investigation techniques, validate the tools, and contribute improvements.
This is an experimental v0.1 release, not a production-ready incident-response solution. The results require independent verification, particularly when assessing industrial process impacts.
Explore the Project
The complete collection is available on GitHub:
OT Security Agent Skills — GitHub
Feedback, technical testing, and contributions from the ICS/OT cybersecurity community are welcome.
The objective is straightforward: use AI to strengthen industrial cybersecurity investigations while keeping evidence, operational safety, and human expertise at the center.
Dr. Sulaiman Alhasawi
ICS/OT Cybersecurity Researcher
