analyzing-network-flow-data-with-netflow

You can detect C2 beaconing and data exfiltration by running NetFlow analysis algorithms on JSON flow files or PCAP captures to identify periodic beaconing patterns and abnormal byte counts. The skill processes v9/IPFIX records to generate structured reports.

Yes, this skill identifies port scanning and network sweeps by analyzing NetFlow/IPFIX records in enterprise networks, labs, and SOC environments. It parses traffic data to detect anomalous connection patterns and generates actionable findings.

The best way to build traffic baselines from IPFIX records is to parse and preprocess the flow data to establish normal traffic patterns. This skill uses detection algorithms to compare traffic against baselines and flag volumetric anomalies.

You do not strictly need PCAP captures; the skill works with both PCAP captures and JSON flow files. It parses NetFlow v9/IPFIX data from either format to produce a structured netflow_report.json for incident response.

NetFlow preprocessing works by parsing raw IPFIX or v9 records into structured data before applying detection algorithms for real-time monitoring. This step normalizes flow data to accurately identify anomalies and validate security coverage.

A limitation when detecting volumetric anomalies from NetFlow v9 records is that detection accuracy depends on established baselines. If baselines are incomplete, false positives may occur during threat hunting or continuous monitoring.