The document D4.1 Cross-Layer Anomaly Detection Framework v1 presents the research and development activities that were made to design and build the first version of two of the SPHINX Toolkit components: Data Traffic Monitoring (DTM) and Anomaly Detection (AD). These components are included in the Automated Cyber Security Risk Assessment block, one of the main high-level SPHINX Architecture building blocks, which deals with advanced and automated tools to assess the level of cyber security of a given environment (e.g., healthcare information technology operational environment).