incident-response-network

Analyze network-forensics artifacts to guide evidence collection across Cisco, Juniper, and Arista devices.

Updated Mar 15, 2026

Search Tags:#incident-response #timeline-reconstruction #evidence-collection #forensic-analysis #network-forensics #flow-records

Ready to run

npx skills add https://github.com/vahagn-madatyan/netsec-skills-suite --skill incident-response-network

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: incident-response-network
Source: https://github.com/vahagn-madatyan/netsec-skills-suite/tree/main/skills/incident-response-network
Command: npx skills add https://github.com/vahagn-madatyan/netsec-skills-suite --skill incident-response-network

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It guides security teams through network-forensics evidence collection and analysis during incidents, ensuring volatile data is preserved, lateral movement is detected, and containment can be verified without affecting live devices.

Core Features & Use Cases

Evidence-preservation workflow for ARP/MAC/CAM, routing state, and flow data across Cisco, Juniper, and Arista devices.
Read-only verification of containment measures and timeline reconstruction from multiple data sources.
Vendor-specific CLI references and methodology for cross-device coordination during incident response.

Quick Start

Start by collecting ARP/MAC tables and routing state for the incident window, then proceed to verify flow records and reconstruct the timeline using read-only commands.

Frequently Asked Questions about incident-response-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I collect network forensics evidence without affecting live Cisco or Juniper devices?▼

Network forensics evidence collection during incident response uses read-only CLI commands to preserve volatile data like ARP, MAC, CAM, and routing state. This ensures volatile data is captured safely across multi-vendor environments without impacting live device operations.

What is the best way to reconstruct an incident timeline from network flow records?▼

Incident timeline reconstruction applies cross-source correlation to network flow records and device state data. By correlating volatile evidence collected across multi-vendor environments, security teams can accurately reconstruct the sequence of events during the incident.

Does this incident response workflow support Arista EOS and Juniper JunOS?▼

Yes, the incident response workflow supports multi-vendor environments including Arista EOS, Juniper JunOS, and Cisco IOS-XE/NX-OS. It provides vendor-specific CLI references and methodology for cross-device evidence collection and coordination during active security incidents.

How do I verify containment measures and detect lateral movement during a security incident?▼

Containment verification and lateral movement detection involve read-only checks of routing state and flow records. By analyzing network-forensics artifacts across devices, teams can verify containment measures and identify lateral movement without altering live network configurations.

When should I use read-only CLI commands for network forensics evidence collection?▼

Read-only CLI commands for network forensics should be used during active incident response when preserving volatile data is critical. They allow security teams to collect ARP, MAC, CAM, and flow data while ensuring live devices remain unaffected and stable.