analyzing-network-flow-data-with-netflow

What problem does it solve?

This skill enables security teams to analyze NetFlow v9/IPFIX records to identify volumetric anomalies, port scanning, data exfiltration, and C2 beaconing in network traffic.

Core Features & Use Cases

• Build traffic baselines from NetFlow data, detect abnormal byte counts and durations, and generate actionable detection findings.
• Identify port scanning, network sweeps, data exfiltration attempts, and periodic beaconing patterns across large-scale networks, labs, or SOC environments.
• Use in incident response, threat hunting, and network monitoring to validate coverage and improve detections for security operations.

Quick Start

Run the NetFlow analysis agent on a JSON flow file or PCAP capture to produce a structured netflow_report.json.