This poster offers guidance on setting up and performing Network Security Monitoring (NSM) with freely available, no-cost tools to carry out active cyber defense in industrial control system (ICS) environments. Several traditional concepts are adapted to provide an "ICS aspect" to further cybersecurity efforts in control networks.