forensic-network

Analyze PCAP files for C2 traffic by reconstructing session timelines and flagging beaconing signatures. This skill supports blue-team triage workflows by identifying anomalous communication patterns from network captures.

Hash-first network traffic analysis ensures evidence integrity and chain of custody during forensic investigations. You need this approach when analyzing network captures for security threats while strictly redacting sensitive credentials and PII.

Yes, you need Tshark or tcpdump to perform network forensics on flow logs. The skill requires these tools for protocol dissection to accurately identify security threats and reconstruct anomalous communication patterns.

You can detect data exfiltration attempts from PCAP captures automatically. The threat detection feature flags potential data exfiltration alongside C2 framework signatures and beaconing activity during traffic analysis.

The best way to redact PII while analyzing network traffic captures is using a hash-first evidence handling policy. This approach ensures sensitive credentials are redacted while maintaining chain of custody for forensic investigations.

Limitations of traffic reconstruction from flow logs include the dependency on Tshark or tcpdump for full protocol dissection. Without these tools, the skill cannot accurately dissect protocols to identify anomalous communication patterns.