hunt-generic

What problem does it solve?

Analyzes network traffic data (PCAP and Suricata EVE JSON) to identify high-priority threats and suspicious activity, enabling faster detection and response.

Core Features & Use Cases

• Structured threat hunting across PCAP and EVE logs, including C2 detection, data exfiltration, DNS tunneling, TLS anomalies, and beaconing.
• Step-by-step hunts that produce actionable indicators (flow IDs, src/dst IPs, ports) for incident responders.
• Use cases include SOC threat hunting, incident containment, and validation of IDS rule effectiveness.

Quick Start

Run the provided hunting queries against your PCAP or EVE JSON dataset and review the consolidated findings to begin investigation.