hunt-generic

Threat hunting in PCAP and Suricata EVE JSON involves running structured hunts to identify high-priority threats and suspicious activity. It analyzes network traffic to detect C2 activity, data exfiltration, DNS tunneling, TLS anomalies, and beaconing, producing actionable indicators for incident response.

You can detect C2 activity, data exfiltration, DNS tunneling, TLS anomalies, and beaconing in Suricata EVE JSON logs. The structured hunts produce flow IDs, source/destination IPs, ports, and summaries of alerts or anomalies for incident responders.

Yes, this supports SOC threat hunting, incident containment, and validation of IDS rule effectiveness. It analyzes PCAP-derived datasets and Suricata EVE JSON logs to produce actionable indicators including flow IDs, source and destination IPs, and ports for investigation.

The best way to investigate suspicious network traffic captured in PCAPs is running structured hunting queries against your dataset. This process identifies high-priority threats and produces consolidated findings with flow IDs, IPs, and ports to begin investigation.

This skill is applicable to both PCAP-derived JSON datasets and Suricata EVE JSON logs. It analyzes these formats to identify high-priority threats and suspicious activity, producing flow IDs, source and destination IPs, ports, and summaries of alerts or anomalies.