skills.rest
vahagn-madatyan
vahagn-madatyanCOMMUNITY
Explore all skills by this author →
Website𝕏@vahagndevGitHub

incident-response-network

Analyze network-forensics artifacts to guide evidence collection across Cisco, Juniper, and Arista devices.

Updated Mar 15, 2026
Search Tags:#incident-response#timeline-reconstruction#evidence-collection#forensic-analysis#network-forensics#flow-records
One-click install
npx skills add https://github.com/vahagn-madatyan/netsec-skills-suite --skill incident-response-network
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-response-network
Source: https://github.com/vahagn-madatyan/netsec-skills-suite/tree/main/skills/incident-response-network
Command: npx skills add https://github.com/vahagn-madatyan/netsec-skills-suite --skill incident-response-network

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It guides security teams through network-forensics evidence collection and analysis during incidents, ensuring volatile data is preserved, lateral movement is detected, and containment can be verified without affecting live devices.

Core Features & Use Cases

  • Evidence-preservation workflow for ARP/MAC/CAM, routing state, and flow data across Cisco, Juniper, and Arista devices.
  • Read-only verification of containment measures and timeline reconstruction from multiple data sources.
  • Vendor-specific CLI references and methodology for cross-device coordination during incident response.

Quick Start

Start by collecting ARP/MAC tables and routing state for the incident window, then proceed to verify flow records and reconstruct the timeline using read-only commands.

Frequently Asked Questions about incident-response-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect network forensics evidence without affecting live Cisco or Juniper devices?▼

Network forensics evidence collection during incident response uses read-only CLI commands to preserve volatile data like ARP, MAC, CAM, and routing state. This ensures volatile data is captured safely across multi-vendor environments without impacting live device operations.

What is the best way to reconstruct an incident timeline from network flow records?▼

Incident timeline reconstruction applies cross-source correlation to network flow records and device state data. By correlating volatile evidence collected across multi-vendor environments, security teams can accurately reconstruct the sequence of events during the incident.

Does this incident response workflow support Arista EOS and Juniper JunOS?▼

Yes, the incident response workflow supports multi-vendor environments including Arista EOS, Juniper JunOS, and Cisco IOS-XE/NX-OS. It provides vendor-specific CLI references and methodology for cross-device evidence collection and coordination during active security incidents.

How do I verify containment measures and detect lateral movement during a security incident?▼

Containment verification and lateral movement detection involve read-only checks of routing state and flow records. By analyzing network-forensics artifacts across devices, teams can verify containment measures and identify lateral movement without altering live network configurations.

When should I use read-only CLI commands for network forensics evidence collection?▼

Read-only CLI commands for network forensics should be used during active incident response when preserving volatile data is critical. They allow security teams to collect ARP, MAC, CAM, and flow data while ensuring live devices remain unaffected and stable.

Related Skills

Explore More Data & Analytics Skills→
vahagn-madatyanvahagn-madatyan

config-management

Back up device configurations and detect drift against golden baselines.

Community
Intermediate
redhat-etredhat-et
1

investigate-incident

Investigate platform incidents by gathering evidence and generating root cause documentation.

Official
Advanced
aviskaaraviskaar
6

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

Official
Advanced
brucesongsbrucesongs
60

digital-forensics

Analyze disk images, memory dumps, and network artifacts with forensic tools.

Community
Advanced