Brick is a lightweight, open-source ICS asset discovery tool for industrial networks built with Claude.
Built on Zeek with CISA's ICSNPP plugins, Brick analyzes network captures to identify Modbus, EtherNet/IP, and S7comm devices, providing a simple asset inventory for compliance and network visibility.
Perfect for smaller facilities that need basic asset discovery without enterprise complexity or cost.
After spending time reviewing existing ICS tooling such as GRASSMARLIN and CISA's Malcolm, I saw a need for a lightweight tool that could be utilzed for simple ICS asset inventory for budget-constrained organizations. A lot of tools in this space are either overkill for something as simple as an asset inventory or exist as a paid product (usually from the hardware vendor). There is no special sauce here, this tool is simply glue for the hard work and effort others have put in.
- Simple - Upload PCAP and view results
- Effective - Easy to navigate with actionable information upfront
- Open Source - Community reviewable and contributor-friendly
Brick consists of two main containers:
- Zeek Container: Runs Zeek with ICSNPP plugins for industrial protocol analysis
- NiceGUI Container: Provides the web interface and manages the SQLite database
┌─────────────────────────────────────────────────────────┐
│ Brick System │
├─────────────────────────────────────────────────────────┤
│ Web Interface (NiceGUI) Zeek Analyzer │
│ ├─ Asset Cards ├─ Modbus Parser │
│ ├─ Connection View ├─ EtherNet/IP Parser │
│ ├─ PCAP Upload ├─ S7comm Parser │
│ └─ SQLite Database └─ JSON Logging │
└─────────────────────────────────────────────────────────┘
- Podman or Docker
- Podman Compose or Docker Compose
- 2GB+ free RAM
- Linux recommended (tested on Ubuntu 24.04 LTS)
Note: macOS and Windows with Docker Desktop should work but are untested. Feedback welcome!
-
Clone the repository:
git clone https://github.com/letsgetweird/brick.git cd brick -
Start the containers:
podman-compose up -d # or docker-compose up -d # or ./reset.sh (just a simple bash script for redeploying with podman)
-
Access the web interface: Open your browser to
http://localhost:8080 -
Upload a PCAP file
Brick includes sample PCAPs in sample-pcaps/:
# Upload these via the web interface:
sample-pcaps/modbus-sample.pcap
sample-pcaps/enip-sample.pcap
sample-pcaps/s7comm-sample.pcapSee sample-pcaps/README.md for sources.
Add custom Zeek scripts to the scripts/ directory. They will be automatically loaded on container startup.
- Click "Upload PCAP" in the web interface
- Select your capture file
- Wait for processing to complete
- View discovered assets in the dashboard
./reset.shThis script stops containers, removes volumes, and cleans up temporary files.
Brick currently supports the following industrial protocols via CISA ICSNPP plugins:
| Protocol | Plugin | Common Use Cases |
|---|---|---|
| Modbus | icsnpp-modbus | PLCs, RTUs, SCADA systems |
| EtherNet/IP | icsnpp-enip | Allen-Bradley PLCs, industrial Ethernet |
| S7comm | icsnpp-s7comm | Siemens PLCs (S7-300, S7-400, S7-1200, S7-1500) |
- ?
Contributions welcome!
- Found a bug? Open an issue
- Have an idea? Open an issue to discuss
- Want to code? Fork, make changes, open a PR
No formal process yet - just be respectful and we'll figure it out together.
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Key points:
- ✅ Commercial use allowed
- ✅ Modification allowed
- ✅ Distribution allowed
- ✅ Patent grant included
- ✅ Private use allowed
⚠️ Must include copyright notice and license⚠️ Must state changes made to code⚠️ Must include NOTICE file if distributed
Built with Zeek, CISA's ICSNPP plugins, and NiceGUI.
- Issues: GitHub Issues
- Discussions: GitHub Discussions
Brick is provided for legitimate security testing and network monitoring purposes only. Users are responsible for ensuring they have appropriate authorization before analyzing network traffic. The authors assume no liability for misuse of this tool.
This tool is designed for trusted, local networks only.
- Do not expose the web UI (port 8080) to untrusted networks
- Only process PCAPs from trusted sources
- The tool performs passive analysis and does not interact with live networks