Abstract—Monitoring network traffic and trying to detectmalicious activities are two of the high significance tasks carriedout by Computer Security Incident Response Teams (CSIRTs).CSIRTs usually use tools to monitor and collect network trafficdata, analyse the data and perform the necessary procedures ifa dangerous activity is detected. However, this captured networktraffic data is in raw format and must be transformed intoa format that data analysis tools and platforms can process.This short paper provides a detailed explanation of several stepsrequired to make sure the data is in good shape for analysis andautomatic detection of malicious traffic. The steps are explainedin a tutorial like manner and demonstrated by being executed toanalyse a publicly available network traffic dataset that containssafe and malicious data. The steps and analysis illustrate that theprocedure helps in making tasks such as automatic classificationand clustering easy