Namanbhatt-01/ics-defensive-parser ? reverse-engineered prompt

Build me a small Python tool that can read stored ICS and SCADA network logs and flag suspicious or non compliant activity without touching the live network.

It should understand Modbus TCP, DNP3, Siemens S7Comm, and IEC 104, then compare each event against a simple rules file so I can define which engineering workstation IPs are trusted and which function codes are allowed. I want it to catch things like unauthorized write attempts, weird or malformed protocol headers, broadcast targets, and out of range command codes, then map those findings to a clear compliance style report.

Please include a simple command line entry point, clean text output, and an audit report file I can review later. Add a few sample logs and rules so it runs out of the box, plus tests that show the main cases are working. If you need current protocol details or best practices, look them up online first.